Topic on Help talk:OAuth

What key is used to sign the JWT (Bearer Token) returned.

$wgOAuth2PrivateKey (as noted on the extension page).

That is the question I am asking. What is that variable set to by Wikipedia APi.

As the variable name might suggest, it's a private key.

And where can I find the public half of that key?

I don't think we are making it public. You are unlikely to need it, it's used by code that needs to authorize access based on OAuth grants.

In theory it could be made public though - if you have a use case, please file a task to discuss it.