Enterprise-grade key registry

Store, validate, and resolve public keys.

pubkey.locker is a curl-friendly keyserver for signed SSH key bundles. Upload a bundle, validate it, and resolve it by handle over HTTPS.

Upload key Read docs View on GitHub

$ curl https://pubkey.locker/alice.keys

$ curl https://pubkey.locker/alice.json

$ curl -X POST https://pubkey.locker/api/keys

$ curl https://pubkey.locker/api/keys/alice

Features

Built for developers, sysadmins, and automated systems.

Signed bundles

Each key bundle includes an ownership proof and optional revocation key.

Validation

Schema checks run before storage and again through CI.

Oracle-backed

Autonomous Database stores bundles with high availability.

curl-friendly

Fetch keys in text and JSON formats from the command line.

Admin controls

Token-protected endpoints for listing and removing bundles.

TLS by default

Caddy provisions and renews certificates automatically.

How it works

A simple flow from upload to resolution.

Prepare

Create a signed key bundle in JSON.

Validate

Check schema, handle, keys, and proof.

Store

Upload to the Oracle-backed API.

Resolve

Fetch by handle over HTTPS.

Upload key bundle

Paste a signed JSON bundle. It is validated before storage.

Bundle JSON

Expected shape

{
  "version": 1,
  "handle": "alice",
  "keys": [{
    "type": "ssh-ed25519",
    "publicKey": "ssh-ed25519 ...",
    "fingerprint": "SHA256:..."
  }],
  "proof": {
    "message": "register alice",
    "signature": "base64...",
    "signedBy": "ssh-ed25519 ..."
  }
}

Lookup handle

Fetch the latest bundle for a handle.

Validate bundle

Check schema and required fields without storing.

Checks

Version is 1
Handle format
Non-empty key list
Supported key types
Proof fields present