Developer Docs

Contract Addresses

Class Hash

Latest declared class hash (Argus):

0x24c091963cb42fdeed6b381d70c90cbdea4730f4fecfb38f5471868fb4236c7

JWKSRegistry ABI (relevant entries)

Use is_key_valid to check whether a JWT kid is registered and active on-chain. Use get_key_if_valid to retrieve the full RSA key struct for signature verification in a single call.

[
  {
    "type": "function",
    "name": "is_key_valid",
    "inputs": [{ "name": "kid", "type": "core::felt252" }],
    "outputs": [{ "type": "core::bool" }],
    "state_mutability": "view"
  },
  {
    "type": "function",
    "name": "get_key",
    "inputs": [{ "name": "kid", "type": "core::felt252" }],
    "outputs": [{ "type": "argus::jwks_registry::JWKSKey" }],
    "state_mutability": "view"
  },
  {
    "type": "function",
    "name": "get_key_if_valid",
    "inputs": [{ "name": "kid", "type": "core::felt252" }],
    "outputs": [{ "type": "argus::jwks_registry::JWKSKey" }],
    "state_mutability": "view"
  }
]

Argus ABI (relevant entries)

register_key is permissionless — any account can submit a Reclaim proof to register a new key. The proof is verified on-chain before writing.

[
  {
    "type": "function",
    "name": "register_key",
    "inputs": [
      { "name": "proof", "type": "argus::argus::Proof" },
      { "name": "kid", "type": "core::felt252" },
      { "name": "key", "type": "argus::jwks_registry::JWKSKey" }
    ],
    "outputs": [],
    "state_mutability": "external"
  },
  {
    "type": "function",
    "name": "get_upgrade_admin",
    "inputs": [],
    "outputs": [{ "type": "core::starknet::contract_address::ContractAddress" }],
    "state_mutability": "view"
  }
]

Reading a Key with starknet.js

Convert the JWT header kid field to a felt252 (UTF-8 big-endian, max 31 bytes), then call is_key_valid on the JWKSRegistry contract.

import { RpcProvider, Contract } from 'starknet';

// Convert a kid string to felt252
function kidToFelt(kid: string): string {
  const bytes = Buffer.from(kid, 'utf8');
  let felt = 0n;
  for (let i = 0; i < Math.min(bytes.length, 31); i++) {
    felt = felt * 256n + BigInt(bytes[i]);
  }
  return '0x' + felt.toString(16);
}

const provider = new RpcProvider({
  nodeUrl: 'https://free-rpc.nethermind.io/mainnet-juno/v0_7',
});

const contract = new Contract(
  [/* minimal ABI with is_key_valid */],
  '0x04dc4a75126ad6b26eae2e1e5d17f7e5436cfe7a2e168b1326d0ac1704aa563e',
  provider,
);

// Check if a Google kid is registered on Mainnet
const kid = 'a3b1...'; // from jwt header
const isValid = await contract.is_key_valid(kidToFelt(kid));
console.log(isValid ? 'Key is active on-chain' : 'Key not registered');

JWKS Endpoints

Security Model

Source Code

The Cairo contracts and this website are open source.