diff --git a/webserver/api.go b/webserver/api.go
index dc7e91f..24d5bb7 100644
--- a/webserver/api.go
+++ b/webserver/api.go
@@ -519,7 +519,9 @@ func keysHandler(w http.ResponseWriter, r *http.Request, g string) {
 				http.StatusUnsupportedMediaType)
 			return
 		}
-		d := json.NewDecoder(r.Body)
+		d := json.NewDecoder(
+			http.MaxBytesReader(w, r.Body, maxAPIMessageSize),
+		)
 		var keys jwkset
 		err = d.Decode(&keys)
 		if err != nil {