> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reflections.ai/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> The OpenAPI document at /api-reference/openapi.yaml defines the target contract. Its x-reflections-availability field and each operation's availability notice identify supported test and live forms. Do not infer implementation from a schema or code sample. Live keys support account details, reads of the licenses the calling account holds as licensee or issued as talent (GET /v1/licenses?role=issuer), and GET /v1/generations?license=… for the state of outputs under such a license (summaries only: no prompt, reference, bytes or metadata). Live image checks, submissions and receipts are built but not activated: until activation, a live POST /v1/checks or /v1/generations returns 403 live_not_activated, which must not be retried. Discovery and JWKS are at the origin root (https://app.reflections.ai/.well-known/...), not under /v1.
> Three rules hold everywhere: a decision is never an error (deny and escalate are 200 responses, and a live check still evaluating is a 202 with status checking); generate nothing for a named talent without an allow; deliver nothing until the generation is allow.
> The sandbox accepts personal rk_test_ keys. Persist a separate Idempotency-Key and body for each logical /v1 POST; retry an unknown outcome with the same key and body. OAuth and Talent API MCP remain planned.
# Discovery and keys
> The /.well-known/talent-license discovery document, and the JWKS that holds the keys for tokens and receipts.
Two public documents let a platform, a generation tool or a verifier work with Reflections without
hard-coding anything: the discovery document lists the endpoints and supported versions, and the
JWKS lists the keys that sign tokens and receipts. Neither needs a key.
The sandbox publishes test keys and only its supported endpoints. The full example below describes
the target discovery contract; session, name-index, OAuth and MCP fields are not currently emitted.
Its example keys are fixtures, not the deployed trust store. Always fetch the live JWKS from the
pinned issuer. Sandbox launch and immediate rotation do not demonstrate the protocol's required
30-day key prepublication or full TLP conformance.
## Discovery document
```bash theme={null}
curl https://app.reflections.ai/.well-known/talent-license
```
The endpoint reference is [Retrieve the discovery document](/api-reference/discovery/retrieve-the-discovery-document).
```json theme={null}
{
"issuer": "https://app.reflections.ai",
"protocol": "tlp",
"protocol_versions": ["1.0"],
"api_base": "https://app.reflections.ai/v1",
"api_versions": ["2026-10-15"],
"jwks_uri": "https://app.reflections.ai/.well-known/jwks.json",
"check_endpoint": "https://app.reflections.ai/v1/checks",
"generation_endpoint": "https://app.reflections.ai/v1/generations",
"session_endpoint": "https://app.reflections.ai/v1/sessions",
"verification_endpoint": "https://app.reflections.ai/v1/verifications",
"receipt_endpoint": "https://app.reflections.ai/v1/receipts/{receipt_id}",
"revocation_feed": "https://app.reflections.ai/v1/revocations",
"talent_index": "https://app.reflections.ai/v1/talent/index",
"authorization_endpoint": "https://app.reflections.ai/oauth/authorize",
"token_endpoint": "https://app.reflections.ai/oauth/token",
"introspection_endpoint": "https://app.reflections.ai/oauth/introspect",
"mcp_endpoint": "https://app.reflections.ai/mcp",
"receipt_page": "https://app.reflections.ai/r/{receipt_id}",
"token_types": ["tlp-auth+jwt", "tlp-session+jwt", "tlp-receipt+jwt"],
"obligation_types": [
"generation_check",
"hold_until_release",
"draft_watermark",
"generation_instructions",
"disclosure",
"attribution",
"c2pa_manifest",
"no_training",
"delete_material",
"usage_report"
],
"c2pa_assertion_label": "ai.reflections.license"
}
```
| Field | Meaning |
| - | - |
| `issuer` | The `iss` of every token and receipt this server signs. |
| `protocol` | Always `tlp`, the [Talent License Protocol](/standard/overview). |
| `protocol_versions` | The protocol versions this server implements. Tokens carry theirs in `tlp.ver`. |
| `api_base` | The base URL of the API. |
| `api_versions` | The dated API versions this server accepts in `Reflections-Version`. |
| `jwks_uri` | The [JWKS](#jwks). |
| `check_endpoint` | Where to [create a check](/api-reference/checks/create-a-check). |
| `generation_endpoint` | Where to [create a generation](/api-reference/generations/create-a-generation). |
| `session_endpoint` | Where to [create a session](/api-reference/sessions/create-a-session). |
| `verification_endpoint` | Where to [verify content](/api-reference/verifications/verify-content). |
| `receipt_endpoint` | Where to [read a receipt](/api-reference/receipts/retrieve-a-receipt). Replace `{receipt_id}`. |
| `revocation_feed` | The [revocation feed](/api-reference/revocations/list-revocations). |
| `talent_index` | The signed [name index](/api-reference/talent/download-the-name-index). |
| `authorization_endpoint` | The [authorization page](/api-reference/oauth/authorize-a-client), for [connections](/api-reference/authentication#connect-a-licensee-with-oauth) and [MCP](/api-reference/mcp/overview). |
| `token_endpoint` | The [token endpoint](/api-reference/oauth/create-an-access-token). |
| `introspection_endpoint` | [Token introspection](/api-reference/oauth/introspect-a-token), for the RSL Open License Protocol. See [RSL](/standard/interop/rsl). |
| `mcp_endpoint` | The [MCP server](/api-reference/mcp/overview) for agents. |
| `receipt_page` | The public receipt page. Replace `{receipt_id}`. |
| `token_types` | The `typ` values of the three signed formats: [authorization token](/api-reference/formats/authorization-token), [session token](/api-reference/formats/session-token), [receipt](/api-reference/formats/receipt). |
| `obligation_types` | Every [obligation type](/concepts/obligations) this server can issue: the 10 types of TLP 1.0, from `generation_check` to `usage_report`. Treat any other type as unmet. |
| `c2pa_assertion_label` | The label of the [C2PA assertion](/api-reference/formats/c2pa-assertion). |
Cache the document for its `Cache-Control` max-age. A platform that finds a talent through another
license server reads that server's document the same way. See [Discovery](/standard/discovery) in
the Standard for how a platform finds the license server for a talent.
## JWKS
The JWKS at `https://app.reflections.ai/.well-known/jwks.json` holds the public keys for every
authorization token, session token and receipt. Each key is an EC P-256 key used for ES256
signatures. The endpoint reference is
[Retrieve the signing keys](/api-reference/discovery/retrieve-the-signing-keys).
```http theme={null}
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=3600
```
```json theme={null}
{
"keys": [
{
"kty": "EC",
"crv": "P-256",
"kid": "rfl-2026-10-docs3",
"use": "sig",
"alg": "ES256",
"x": "ZoYofSbzIa2end2Uk8RWL2lqZA8h1yhqDUPTdAeguns",
"y": "ufMrUfKD5j5lbepL80bq9gxm81nQ0Zy0n8ABI5ZorZ0"
},
{
"kty": "EC",
"crv": "P-256",
"kid": "rfl-2026-04-docs3",
"use": "sig",
"alg": "ES256",
"x": "smCKFBms8rHn_zcLkGN7leNXC0Kw0tMUos5Ptq3vTP8",
"y": "aXhqxlAT_XFcwIvpRfcQ3_F-osigj44ekOnIjTBcoRw"
},
{
"kty": "EC",
"crv": "P-256",
"kid": "rfl-test-2026-10-docs3",
"use": "sig",
"alg": "ES256",
"x": "olA2YiuvUovqtC-h3GQzdrJtqrG0cyh1YPgnzrBjVy8",
"y": "D7LpiphUIzpegpDaxDAj9NDmXi4ht4ADhSlphr8JCBc"
}
]
}
```
| Field | Value |
| - | - |
| `kty`, `crv` | `EC`, `P-256` |
| `kid` | The key ID a token or receipt names in its header. New test keys have unique suffixes, such as `rfl-test-2026-10-a1b2c3d4`; older IDs remain valid while their public keys are retained. |
| `use`, `alg` | `sig`, `ES256` |
| `x`, `y` | The public key's coordinates, base64url. |
The `rfl-2026-10-docs3` key in this example verifies the example authorization token, session token and
receipt in the [API reference](/api-reference/introduction), so you can test a verifier against them.
### Rotation
* The target protocol requires a new key to be published 30 days before it signs anything. Refreshing on the `Cache-Control`
max-age is enough to have it before its first use.
* Retired keys stay published, so old receipts keep verifying. In the example, `rfl-2026-04-docs3` no
longer signs but still verifies what it signed.
* A `kid` is never reused.
* Cache the JWKS for its max-age. When a token or receipt names a `kid` you do not have, refetch
the JWKS once; if the `kid` is still missing, reject it.
* In live mode, reject tokens signed by a `rfl-test-` key.
## Related
Verify a token with these keys.
How a platform finds the license server for a talent.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.