Retrieve JSON Web Key Set (JWKS)

Fetches the public keys that can be used to verify JWTs signed by Prolific. Clients should cache these keys and update them at least daily.

To verify the signature of a JWT you must verify the following:

• The JWT signature is authentic by verifying it with the public key from Prolific that correlates with the KID.
• The JWT hasn’t expired, by checking the exp claim.
• The aud claim is the correct domain for your tool.
• The prolific claim matches your expected payload as set in the external_study_url property. It always includes PROLIFIC_PID, STUDY_ID, SESSION_ID, and workspace_id. When the workspace is linked to an organisation, it also includes organisation_id.