SPKI Public Key Format
SubjectPublicKeyInfo, commonly called SPKI, is the standard ASN.1 structure for public keys and is frequently serialized as PEM blocks labeled PUBLIC KEY. JWT verifiers using RS256 or ES256 may load SPKI PEM for the public key while the issuer keeps PKCS #8 private material offline. JWKS can represent the same public key as a JWK, which many OAuth and OIDC stacks prefer for automated rotation. Understanding SPKI helps when converting between OpenSSL outputs, browser-generated PEMs, and runtime verifiers in different languages. Public SPKI material is safe to distribute, but you must still authenticate its distribution channel so attackers cannot substitute verification keys silently.
Why It Matters
If verifiers load the wrong public key format or an outdated SPKI document, signatures fail and customer-facing outages follow quickly. Publish SPKI or JWK through controlled channels such as JWKS URIs with monitoring. Never rely on attacker-supplied header URLs to fetch replacement public keys without strict allowlists and pinning controls. Export and store public keys in one agreed format (SPKI PEM or JWK) and test import on every verifier language you ship. Version the public key artifact beside kid so rollouts never guess which PEM belongs to which signing key.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Can I share SPKI publicly?
Yes. SPKI encodes a public key. Still distribute it via trusted HTTPS or JWKS so clients do not accept substituted keys from untrusted channels.
How does SPKI differ from x5c?
x5c embeds certificates that contain public keys plus identity binding metadata. SPKI is the bare public key structure without the full certificate.
Do browsers export SPKI?
Web Crypto can export public keys as SPKI ArrayBuffers. Our RSA Key Generator surfaces PEM suitable for common JWT verification libraries across Node, Python, and Go.