> ## Documentation Index > Fetch the complete documentation index at: https://docs.yourflexpay.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the IDaaS public encryption key > Returns the IDaaS EC P-256 public key in two formats: - **`jwk`** – JSON Web Key (JWK) format; import directly into any JOSE library. - **`publicKeyBase64`** – Base64-encoded X.509 (SubjectPublicKeyInfo) DER; use with `KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(decoded))` in Java. Use this key to **encrypt request payloads** before sending them to IDaaS: ``` 1. Serialize your JSON request body. 2. Encrypt with JWE (alg=ECDH-ES+A256KW, enc=A256GCM) using this public key. 3. Set header: Content-Encryption: JWE 4. Send the JWE compact string as the request body. ``` This endpoint is **unauthenticated** – public keys are safe to distribute. Cache the response; refresh only if you encounter a JWE decryption error (HTTP 400). ## OpenAPI ````yaml /openapi/idaas.openapi.json get /v1/keys/idaas openapi: 3.0.3 info: title: IDaaS – Identity as a Service API description: > ## Overview IDaaS provides globally unique, portable identity **tags** that travel with users across applications. Each tag is a short handle (e.g. `@alice`) that can carry verified claims, participate in cross-application payments, and be federated to external identity providers. ## Key Capabilities - **Tags** – create, transfer, disable, and attach claims to identity handles. - **Cross-application payments** – send money from any tag on Application A to any tag on Application B; each application has a single escrow wallet tracked for end-of-day settlement. - **Ledger** – every completed payment produces an immutable double-entry `DEBIT` / `CREDIT` pair recorded against application wallets. - **Webhooks** – real-time callbacks with HMAC-SHA256 signatures and automatic retry (up to 3 attempts with exponential back-off). - **Settlement** – a scheduled end-of-day job aggregates daily wallet movements and emits `SETTLEMENT_BATCH` Kafka events. ## Authentication 1. Register an application: `POST /v1/applications` 2. Exchange credentials for a JWT: `POST /v1/auth/token` 3. Include the JWT as `Authorization: Bearer ` on all protected calls. ## Rate Limits | Endpoint | Limit | |---|---| | `POST /v1/auth/token` | 10 req / min per IP | | `POST /v1/transactions` | 60 req / min per application | | All other | 300 req / min per IP | contact: name: ReflexPay Platform Team url: https://yourflexpay.com email: integration@yourflexpay.com license: name: Proprietary url: https://yourflexpay.com/terms version: 1.0.0 servers: - url: https://staging-idaas.yourflexpay.com/api description: Staging - url: https://idaas.yourflexpay.com/api description: Production security: - bearerAuth: [] tags: - name: Authentication description: Exchange client credentials for a JWT access token. - name: Encryption description: > JWE payload encryption – end-to-end security for API request bodies and webhook payloads. Each application receives an EC P-256 keypair at registration: - IDaaS encrypts **outbound webhooks** with the application's public key. - Applications encrypt **inbound request bodies** with the IDaaS public key. Algorithm: ECDH-ES+A256KW + A256GCM (JSON Web Encryption, RFC 7516). Use `GET /v1/keys/idaas` to fetch the IDaaS public key. Use `POST /v1/applications/keys/rotate` to rotate your application keypair. - name: Wallet description: View application escrow wallet balance and paginated ledger statement. - name: Subjects description: Manage the real-world entities (users / organisations) behind tags. - name: Tags description: Create, transfer, disable and resolve globally unique identity tags. - name: Claims description: Attach and revoke verifiable claims on tags. - name: Consent description: Issue and manage user consent tokens for claim federation. - name: Transactions description: Initiate, accept/reject, and query cross-application tag-to-tag payments. - name: Settlement description: Query end-of-day settlement batches and per-application net positions. - name: Webhooks description: >- Inspect outbound webhook delivery records for transactions. Each transaction has at most two webhook records: one RECEIVER (sent on initiation) and one SENDER (sent on acceptance/rejection/expiry). externalDocs: description: IDaaS GitHub Repository url: https://github.com/reflexpay/idaas paths: /v1/keys/idaas: get: tags: - Encryption summary: Get the IDaaS public encryption key description: > Returns the IDaaS EC P-256 public key in two formats: - **`jwk`** – JSON Web Key (JWK) format; import directly into any JOSE library. - **`publicKeyBase64`** – Base64-encoded X.509 (SubjectPublicKeyInfo) DER; use with `KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(decoded))` in Java. Use this key to **encrypt request payloads** before sending them to IDaaS: ``` 1. Serialize your JSON request body. 2. Encrypt with JWE (alg=ECDH-ES+A256KW, enc=A256GCM) using this public key. 3. Set header: Content-Encryption: JWE 4. Send the JWE compact string as the request body. ``` This endpoint is **unauthenticated** – public keys are safe to distribute. Cache the response; refresh only if you encounter a JWE decryption error (HTTP 400). operationId: getIdaasPublicKey responses: '200': description: IDaaS public key returned content: '*/*': schema: $ref: '#/components/schemas/ApiResponseMapStringObject' security: [] components: schemas: ApiResponseMapStringObject: type: object properties: success: type: boolean message: type: string errorCode: type: string data: type: object additionalProperties: type: object errors: type: array items: type: string timestamp: type: string format: date-time securitySchemes: bearerAuth: type: http description: > Obtain a token from `POST /v1/auth/token` using your `client_id` and `client_secret`, then enter `Bearer ` here. scheme: bearer bearerFormat: JWT ````