Discovery and keys

Two public documents let a platform, a generation tool or a verifier work with Reflections without hard-coding anything: the discovery document lists the endpoints and supported versions, and the JWKS lists the keys that sign tokens and receipts. Neither needs a key.

The sandbox publishes test keys and only its supported endpoints. The full example below describes the target discovery contract; session, name-index, OAuth and MCP fields are not currently emitted. Its example keys are fixtures, not the deployed trust store. Always fetch the live JWKS from the pinned issuer. Sandbox launch and immediate rotation do not demonstrate the protocol’s required 30-day key prepublication or full TLP conformance.

Discovery document

curl https://app.reflections.ai/.well-known/talent-license

The endpoint reference is Retrieve the discovery document.

{
  "issuer": "https://app.reflections.ai",
  "protocol": "tlp",
  "protocol_versions": ["1.0"],
  "api_base": "https://app.reflections.ai/v1",
  "api_versions": ["2026-10-15"],
  "jwks_uri": "https://app.reflections.ai/.well-known/jwks.json",
  "check_endpoint": "https://app.reflections.ai/v1/checks",
  "generation_endpoint": "https://app.reflections.ai/v1/generations",
  "session_endpoint": "https://app.reflections.ai/v1/sessions",
  "verification_endpoint": "https://app.reflections.ai/v1/verifications",
  "receipt_endpoint": "https://app.reflections.ai/v1/receipts/{receipt_id}",
  "revocation_feed": "https://app.reflections.ai/v1/revocations",
  "talent_index": "https://app.reflections.ai/v1/talent/index",
  "authorization_endpoint": "https://app.reflections.ai/oauth/authorize",
  "token_endpoint": "https://app.reflections.ai/oauth/token",
  "introspection_endpoint": "https://app.reflections.ai/oauth/introspect",
  "mcp_endpoint": "https://app.reflections.ai/mcp",
  "receipt_page": "https://app.reflections.ai/r/{receipt_id}",
  "token_types": ["tlp-auth+jwt", "tlp-session+jwt", "tlp-receipt+jwt"],
  "obligation_types": [
    "generation_check",
    "hold_until_release",
    "draft_watermark",
    "generation_instructions",
    "disclosure",
    "attribution",
    "c2pa_manifest",
    "no_training",
    "delete_material",
    "usage_report"
  ],
  "c2pa_assertion_label": "ai.reflections.license"
}

Field	Meaning
`issuer`	The `iss` of every token and receipt this server signs.
`protocol`	Always `tlp`, the Talent License Protocol.
`protocol_versions`	The protocol versions this server implements. Tokens carry theirs in `tlp.ver`.
`api_base`	The base URL of the API.
`api_versions`	The dated API versions this server accepts in `Reflections-Version`.
`jwks_uri`	The JWKS.
`check_endpoint`	Where to create a check.
`generation_endpoint`	Where to create a generation.
`session_endpoint`	Where to create a session.
`verification_endpoint`	Where to verify content.
`receipt_endpoint`	Where to read a receipt. Replace `{receipt_id}`.
`revocation_feed`	The revocation feed.
`talent_index`	The signed name index.
`authorization_endpoint`	The authorization page, for connections and MCP.
`token_endpoint`	The token endpoint.
`introspection_endpoint`	Token introspection, for the RSL Open License Protocol. See RSL.
`mcp_endpoint`	The MCP server for agents.
`receipt_page`	The public receipt page. Replace `{receipt_id}`.
`token_types`	The `typ` values of the three signed formats: authorization token, session token, receipt.
`obligation_types`	Every obligation type this server can issue: the 10 types of TLP 1.0, from `generation_check` to `usage_report`. Treat any other type as unmet.
`c2pa_assertion_label`	The label of the C2PA assertion.

Cache the document for its Cache-Control max-age. A platform that finds a talent through another license server reads that server’s document the same way. See Discovery in the Standard for how a platform finds the license server for a talent.

JWKS

The JWKS at https://app.reflections.ai/.well-known/jwks.json holds the public keys for every authorization token, session token and receipt. Each key is an EC P-256 key used for ES256 signatures. The endpoint reference is Retrieve the signing keys.

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=3600

{
  "keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "kid": "rfl-2026-10-docs3",
      "use": "sig",
      "alg": "ES256",
      "x": "ZoYofSbzIa2end2Uk8RWL2lqZA8h1yhqDUPTdAeguns",
      "y": "ufMrUfKD5j5lbepL80bq9gxm81nQ0Zy0n8ABI5ZorZ0"
    },
    {
      "kty": "EC",
      "crv": "P-256",
      "kid": "rfl-2026-04-docs3",
      "use": "sig",
      "alg": "ES256",
      "x": "smCKFBms8rHn_zcLkGN7leNXC0Kw0tMUos5Ptq3vTP8",
      "y": "aXhqxlAT_XFcwIvpRfcQ3_F-osigj44ekOnIjTBcoRw"
    },
    {
      "kty": "EC",
      "crv": "P-256",
      "kid": "rfl-test-2026-10-docs3",
      "use": "sig",
      "alg": "ES256",
      "x": "olA2YiuvUovqtC-h3GQzdrJtqrG0cyh1YPgnzrBjVy8",
      "y": "D7LpiphUIzpegpDaxDAj9NDmXi4ht4ADhSlphr8JCBc"
    }
  ]
}

Field	Value
`kty`, `crv`	`EC`, `P-256`
`kid`	The key ID a token or receipt names in its header. New test keys have unique suffixes, such as `rfl-test-2026-10-a1b2c3d4`; older IDs remain valid while their public keys are retained.
`use`, `alg`	`sig`, `ES256`
`x`, `y`	The public key’s coordinates, base64url.

The rfl-2026-10-docs3 key in this example verifies the example authorization token, session token and receipt in the API reference, so you can test a verifier against them.

Rotation

The target protocol requires a new key to be published 30 days before it signs anything. Refreshing on the Cache-Control max-age is enough to have it before its first use.
Retired keys stay published, so old receipts keep verifying. In the example, rfl-2026-04-docs3 no longer signs but still verifies what it signed.
A kid is never reused.
Cache the JWKS for its max-age. When a token or receipt names a kid you do not have, refetch the JWKS once; if the kid is still missing, reject it.
In live mode, reject tokens signed by a rfl-test- key.

Authorization token

Verify a token with these keys.

Discovery in the Standard

How a platform finds the license server for a talent.

Overview

Account

Talent

Facets

Resolutions

Licenses

License requests

Connections

Files

Checks

Generations

Sessions

Receipts

Verifications

Revocations

Usage records

Statements

Mandates

Escalations

License drafts

Webhook endpoints

Events

Discovery

OAuth

Test helpers

Webhooks

Real-time

Formats

MCP

Discovery document

JWKS

Rotation

Authorization token

Discovery in the Standard

​Discovery document

​JWKS

​Rotation

​Related

Authorization token

Discovery in the Standard

Discovery document

JWKS

Rotation

Related