The .well-known/jwks endpoint returns an array of JSON Web Key Sets, in the following format:

"keys": [
  {
    "kty": "<Key Type>",
    "alg": "<Algorithm eg: RS256>",
    "use": "<sig | enc>",
    "kid": "<UUID>",
    "n": "<modulus>",
    "e": "<exponent>"
  },
]

You can use this cURL as an example to get Github's JWKS:

curl --request GET \
  --url https://token.actions.githubusercontent.com/.well-known/jwks

First of all, note that its an array of public keys. This allows for the host to be able to invalidate a given key without breaking any API contracts.

Breaking down the response:

kty (Key Type)

Cryptographic algorithm family (eg: RSA)

alg (Alrogithm)

The specific signing algorithm (eg: RS256)

use (Public key use)

• sig = signing
• enc = encryption

signing is a an indication that the key is intended for signing rather than encryption i.e. that this key should be used to verify a JWT (JSON Web Token), not to encrypt data.

kid (Key ID)

The ID (UUID) of the key. When you're trying to verify a certain JWT, you can read the token's KID and then do a lookup for that KID in the response from a host's .well-known/jwks endpoint.

n (Modulus)

The RSA modulus (n in n = p*q) — the big number that makes RSA work. Useful stack overflow post

e (Exponent)

RSA public exponent (almost always AQAB, which is 65537).