How to check ClearRun receipts in your own systems

Store the receipt from each response, keep a copy of ClearRun's public keys, and check the Ed25519 signature and verdictHash when you need proof. For a quick check, call the public lookup and read verified.

Last updated

Steps

  1. Store the receipt

    Save the whole response: the receipt and the verdict, with the verdict id. On new receipts anyone can check verdictHash from the public lookup. For older receipts, recomputing it needs your own copy of the verdict.

  2. Keep the keys

    curl -s https://api.clearrun.net/.well-known/jwks.json > clearrun-jwks.json

  3. Check when needed

    Run the signature check from How to check a ClearRun receipt signature yourself against your stored copy.

Quick vs. independent

Quick vs. independent
CheckNeeds ClearRun onlineTrusts ClearRun's answer
GET /api/verify/{id}YesYes
Your own signature checkNo, with saved keysNo