A minimal key object for ActivityPub

examplekey.jsonld

{
  "@context": [
    "https://www.w3.org/ns/activitystreams",
    "https://w3id.org/security/v1",
  ],
  "id": "https://social.example/key/MZ46DLELS2e2sdggQO4aD",
  "type": "Key",
  "owner": "https://social.example/person/SEv678nDpuylYzZmdsfB9",
  "publicKeyPem": "<key material goes here>",
  "to": "as:Public",
  "attributedTo": "https://social.example/person/SEv678nDpuylYzZmdsfB9",
  "published": "2026-01-11T18:19:14Z"
}

  "type": "Key",

https://w3id.org/security/v1 defines this as CryptographicKey (which maps to "@id": "sec:Key" or fully https://w3id.org/security#Key)

---

  "type": "Key",

  "to": "as:Public",
  "attributedTo": "https://social.example/person/SEv678nDpuylYzZmdsfB9",
  "published": "2026-01-11T18:19:14Z"

minimally, this is not needed. using the security v1 context, all you need is publicKeyPem (from which you can infer the current object is a sec:Key) and owner (which is sec:owner, your backlink to the key's owner)

the minimal object is this:

{
  "@context": "https://w3id.org/security/v1",
  "id": "https://social.example/key/MZ46DLELS2e2sdggQO4aD",
  "publicKeyPem": "<key material goes here>",
  "owner": "https://social.example/person/SEv678nDpuylYzZmdsfB9"
}

also of note: owner was deprecated in favor of controller (sec:controller, https://w3id.org/security#controller) because the concept of "ownership" doesn't really make sense for keys -- the key can be used by a controller for various purposes, and newer work using the Security Vocabulary defines an identity's verificationMethods which may be used for authentication (logging in), assertionMethod (making claims), keyAgreement (initiating communication sessions), capabilityInvocation (using object capabilities), and capabilityDelegation (granting limited or full capabilities to another identity on your behalf). support for newer vocab (controller, publicKeyMultibase) is less widespread than older vocab (owner, publicKeyPem) but more than zero.