JOSE

Wise uses the JOSE framework to accept and respond with signed and encrypted payloads. These endpoints allow you to manage keys and test your signing and encryption implementation.

For more information, please speak with your Implementation team.

Operations

Get Wise JOSE public key

Request

Returns a public key issued by Wise.

Depending on the scope requested, the key will be used for verifying HTTP responses signed by Wise or for for encrypting the payload prior to sending it to Wise.

For both signature verification and payload encryption, the process involves storing this public key after retrieval. In both cases, the stored public key should be used without calling this endpoint.

If verification of the signed request fails or Wise is unable to decrypt your request payload, call this API to issue a fresh key from Wise and reattempt the operation again.

This endpoint requires a client credentials token, not a user level access token. Make sure you use your client details to fetch a valid client credentials token before performing this call.

Security

ClientCredentialsToken

Query

versioninteger, (int32)

Fetch a specific public key version. If omitted the most recent public key is provided.

algorithmstringrequired

Algorithm to be used for signature verification or payload encryption. This must match the algorithm used during request.

Signature verification (Scope: PAYLOAD_SIGNING): ES256, ES384, ES512, PS256, PS384, PS512
Payload encryption (Scope: PAYLOAD_ENCRYPTION): RSA_OAEP_256

Enum:"ES256""ES384""ES512""PS256""PS384""PS512""RSA_OAEP_256"

Example:algorithm=ES512

scopestringrequired

Scope of the key. Must be PAYLOAD_SIGNING or PAYLOAD_ENCRYPTION.

Enum:"PAYLOAD_SIGNING""PAYLOAD_ENCRYPTION"

Example:scope=PAYLOAD_SIGNING

X-External-Correlation-Idstring, (uuid), <= 36 characters

Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Example:f47ac10b-58cc-4372-a567-0e02b2c3d479

const query = new URLSearchParams({
  version: '0',
  algorithm: 'ES512',
  scope: 'PAYLOAD_SIGNING'
}).toString();

const resp = await fetch(
  `https://api.wise-sandbox.com/2026Q3/auth/jose/response/public-keys?${query}`,
  {
    method: 'GET',
    headers: {
      'X-External-Correlation-Id': 'f47ac10b-58cc-4372-a567-0e02b2c3d479',
      Authorization: 'Bearer <YOUR_JWT_HERE>'
    }
  }
);

const data = await resp.text();
console.log(data);

Responses

Public key object.

Headers

X-External-Correlation-Idstring, (uuid), <= 36 characters

Echoed back when X-External-Correlation-Id was included in the request. Learn more.

Example:"f47ac10b-58cc-4372-a567-0e02b2c3d479"

x-trace-idstring

Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.

Example:"fba501b6d453b96789f52338f019341f"

Bodyapplication/json

keyIdstring, (UUID)

ID of the key in UUID format.

versioninteger, (int32)

Version of the public key issued.

keyMaterialobject

scopestring

Scope of the key.