Mojang Keys API

openapi: 3.2.0
info:
  title: Minecraft Services Keys API
  description: Microsoft-managed Minecraft Services API (api.minecraftservices.com). Covers authenticated player profile management, name change, skin and cape management, player attributes (chat, friends, profanity filter), privacy blocklist, friends graph, presence reporting, signature keypair issuance, public-key publication for chat signature verification, and player entitlement / ownership checks. Most endpoints require a Minecraft Bearer access token obtained via the Xbox Live -> XSTS -> Minecraft authentication chain.
  version: 1.0.0
  contact:
    name: Mojang Studios
    url: https://www.minecraft.net
  license:
    name: Mojang Brand and Asset Usage Guidelines
    url: https://www.minecraft.net/en-us/usage-guidelines
  x-generated-from: documentation
  x-last-validated: '2026-05-30'
servers:
- url: https://api.minecraftservices.com
  description: Microsoft / Minecraft Services API (production)
security: []
tags:
- name: Keys
  description: Signature keypairs and Mojang public keys
paths:
  /player/certificates:
    post:
      operationId: getPlayerCertificates
      summary: Get Player Certificates
      description: Issue an RSA keypair plus Mojang signatures for use in signing the player's outbound chat. Keys rotate roughly every 48 hours.
      tags:
      - Keys
      security:
      - bearerAuth: []
      responses:
        '200':
          description: Player keypair and signature material.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PlayerCertificates'
        '401':
          description: Missing or invalid access token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /publickeys:
    get:
      operationId: getPublicKeys
      summary: Get Mojang Public Keys
      description: Return the current Mojang public keys used to verify profile property signatures, player chat-signing certificates, and authentication artefacts.
      tags:
      - Keys
      responses:
        '200':
          description: Public-key bundle.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublicKeys'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    PublicKeys:
      type: object
      description: Mojang public keys for verifying signatures.
      properties:
        profilePropertyKeys:
          type: array
          description: Keys used to verify session-profile property signatures.
          items:
            $ref: '#/components/schemas/PublicKeyEntry'
        playerCertificateKeys:
          type: array
          description: Keys used to verify player chat-signature certificates.
          items:
            $ref: '#/components/schemas/PublicKeyEntry'
        authenticationKeys:
          type: array
          description: Keys used to verify Mojang authentication tokens.
          items:
            $ref: '#/components/schemas/PublicKeyEntry'
    Error:
      type: object
      description: Standard Minecraft Services error envelope.
      properties:
        path:
          type: string
          description: Request path that produced the error.
          example: /minecraft/profile/lookup/name/zzzzzzzzzzzzzz
        errorType:
          type: string
          description: Mojang error class.
          example: NOT_FOUND
        error:
          type: string
          description: Short error name.
          example: NOT_FOUND
        errorMessage:
          type: string
          description: Human-readable description.
          example: Couldn't find any profile with name zzzzzzzzzzzzzz
        developerMessage:
          type: string
          description: Optional developer-facing message.
          example: Couldn't find any profile with name zzzzzzzzzzzzzz
    PlayerCertificates:
      type: object
      description: Player keypair payload returned by /player/certificates.
      properties:
        keyPair:
          type: object
          description: PEM-encoded RSA keypair.
          properties:
            privateKey:
              type: string
              example: '-----BEGIN RSA PRIVATE KEY-----...'
            publicKey:
              type: string
              example: '-----BEGIN RSA PUBLIC KEY-----...'
        publicKeySignature:
          type: string
          description: Mojang signature over the public key (legacy).
          example: a1b2c3...
        publicKeySignatureV2:
          type: string
          description: Mojang signature including player UUID (v2).
          example: a1b2c3...
        expiresAt:
          type: string
          format: date-time
          description: Keypair expiry time.
          example: '2026-06-01T00:00:00Z'
        refreshedAfter:
          type: string
          format: date-time
          description: Earliest time the client should re-request the keypair.
          example: '2026-05-31T12:00:00Z'
    PublicKeyEntry:
      type: object
      description: A single Base64-encoded DER public key entry.
      required:
      - publicKey
      properties:
        publicKey:
          type: string
          description: Base64-encoded DER public key.
          example: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC...
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'Minecraft access token issued by /authentication/login_with_xbox. Used as `Authorization: Bearer {token}`.'