Hanko .well-known API
The .well-known API from Hanko — 2 operation(s) for .well-known.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/hanko-well-known-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
version: 1.2.0
title: Hanko Public .well Known API
description: '## Introduction
This is the OpenAPI specification for the [Hanko Public API](https://github.com/teamhanko/hanko/blob/main/backend/README.md#basic-usage).
## Authentication
The API uses [JSON Web Tokens](https://www.rfc-editor.org/rfc/rfc7519.html) (JWTs) for authentication.
JWTs are verified using [JSON Web Keys](https://www.rfc-editor.org/rfc/rfc7517) (JWK).
JWKs can be [configured](https://github.com/teamhanko/hanko/blob/main/backend/docs/Config.md#all-available-config-options)
through the `secrets.keys` options. The API also publishes public cryptographic keys as a
[JWK set](https://www.rfc-editor.org/rfc/rfc7517#section-2) through the `.well-known/jwks.json` endpoint
to enable clients to verify token signatures.
JWTs must be provided on requests to protected endpoints using one of the following schemes:
### CookieAuth
**Security Scheme Type**: `API Key`
**Cookie parameter name**: `hanko`
The JWT must be provided in a Cookie with the name `hanko`.
### BearerTokenAuth
**Security Scheme Type**: `http`
**HTTP Authorization Scheme**: `Bearer`
**Bearer format**: `JWT`
The JWT must be provided in an HTTP Authorization header with bearer type: `Authorization: Bearer <JWT>`.
## Cross-Origin Resource Sharing
Cross-Origin Resource Sharing (CORS) can be currently
[configured](https://github.com/teamhanko/hanko/blob/main/backend/docs/Config.md#all-available-config-options)
for public endpoints via the `server.public.cors` options.
---
'
contact:
email: developers@hanko.io
license:
name: AGPL-3.0-or-later
url: https://www.gnu.org/licenses/agpl-3.0.txt
servers:
- url: https://{tenant_id}.hanko.io
variables:
tenant_id:
default: ''
description: The (UU)ID of a tenant. Replace the default value with your tenant ID.
tags:
- name: .well-known
paths:
/.well-known/jwks.json:
get:
summary: Get JSON Web Key Set
description: 'Retrieve a [JSON Web Key Set](https://www.rfc-editor.org/rfc/rfc7517#section-5) (JWKS) object containing the public `keys` used to verify
JSON Web Tokens (JWT) issued by the Hanko API and signed using the RS256 signing algorithm.
'
operationId: getJwks
tags:
- .well-known
responses:
'200':
description: JSON Web Key Set
content:
application/json:
schema:
$ref: '#/components/schemas/JSONWebKeySet'
'500':
$ref: '#/components/responses/InternalServerError'
/.well-known/config:
get:
deprecated: true
summary: Get public Hanko configuration
description: 'Retrieve public backend configuration options.
Useful for example for conditionally constructing a UI based on the options (e.g. don''t show password
inputs when they are disabled).
'
operationId: getConfig
tags:
- .well-known
responses:
'200':
description: Hanko configuration
content:
application/json:
schema:
$ref: '#/components/schemas/HankoConfiguration'
components:
schemas:
JSONWebKey:
type: object
externalDocs:
description: RFC7517 - JSON Web Key (JWK)
url: https://datatracker.ietf.org/doc/html/rfc7517
properties:
alg:
type: string
example: RS256
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 4.4
url: https://www.rfc-editor.org/rfc/rfc7517#section-4.4
e:
type: string
format: base64url
example: AQAB
externalDocs:
description: RFC7518 - JSON Web Algorithms (JWA) - Section 6.3.1.2
url: https://www.rfc-editor.org/rfc/rfc7518#section-6.3.1.2
kid:
type: string
example: d6ff37d7-e3d1-4432-ab80-b64faf55ae36
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 4.5
url: https://www.rfc-editor.org/rfc/rfc7517#section-4.5
kty:
type: string
example: RSA
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 4.1
url: https://www.rfc-editor.org/rfc/rfc7517#section-4.1
n:
type: string
format: base64url
example: vPFRUCRoxN3RygdJHR3S5BV-DDLw6n-7oUXtX0nr7Twl...
externalDocs:
description: RFC7518 - JSON Web Algorithms (JWA) - Section 6.3.1.1
url: https://www.rfc-editor.org/rfc/rfc7518#section-6.3.1.1
use:
type: string
example: sig
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 4.2
url: https://www.rfc-editor.org/rfc/rfc7517#section-4.2
Error:
type: object
required:
- code
- message
properties:
code:
type: integer
format: int32
message:
type: string
HankoConfiguration:
description: Public backend configuration options
type: object
externalDocs:
description: Hanko Configuration
url: https://github.com/teamhanko/hanko/blob/main/backend/docs/Config.md
properties:
emails:
description: Controls the behavior regarding email addresses.
type: object
properties:
require_verification:
description: Require email verification after account registration and prevent signing in with unverified email addresses. Also, email addresses can only be marked as primary when they have been verified before.
type: boolean
password:
description: Configuration options concerning passwords
type: object
properties:
enabled:
description: Indicates whether passwords are enabled or not
type: boolean
min_password_length:
description: Describes the minimum password length
type: number
example: 8
account:
description: Controls the behavior regarding user account.
type: object
properties:
allow_deletion:
description: Indicates the user account can be deleted by the current user.
type: boolean
allow_signup:
description: Indicates users are able to create new accounts.
type: boolean
JSONWebKeySet:
type: object
properties:
keys:
type: array
items:
$ref: '#/components/schemas/JSONWebKey'
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 5.1
url: https://www.rfc-editor.org/rfc/rfc7517#section-5.1
externalDocs:
description: RFC7517 - JSON Web Key (JWK) - Section 5
url: https://www.rfc-editor.org/rfc/rfc7517#section-5
responses:
InternalServerError:
description: Internal server error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
code: 500
message: Internal Server Error
securitySchemes:
CookieAuth:
type: apiKey
in: cookie
name: hanko
BearerTokenAuth:
type: http
scheme: bearer
bearerFormat: JWT
externalDocs:
description: More about Hanko
url: https://github.com/teamhanko/hanko