openproof-verify

Verify OpenProof cryptographic signatures on API responses.

OpenProof is an open protocol that adds ECDSA signatures to every API response — so AI agents can cryptographically verify that data came from the claimed source and hasn't been tampered with.

Install

npm install openproof-verify
# or
npm install openproof-verify ethers  # recommended for full signature recovery

Usage

const { verify, verifyResponse } = require('openproof-verify')

// From a Yantrix API response:
const response = await fetch('https://agent-registry.yantrix.ai/v1/agents/agt_abc123')
const json = await response.json()

// Verify the signature
const result = verifyResponse(json)

if (result.valid) {
  console.log('✓ Response verified')
  console.log('  Signed by:', result.signer)
  console.log('  Signed at:', new Date(result.signed_at * 1000).toISOString())
} else {
  console.error('✗ Verification failed:', result.reason)
}

With trusted signers

const result = verify(json.data, json._proof, {
  trustedSigners: ['0x41a024c1c89fd30122c8b184de99cbe751eac970'],
  maxAgeSeconds: 60,  // reject signatures older than 1 minute
})

Remote verification

const { verifyRemote } = require('openproof-verify')

const result = await verifyRemote(
  'https://agent-registry.yantrix.ai',
  json.data,
  json._proof
)

What is OpenProof?

OpenProof adds a _proof envelope to every API response:

{
  "data": { "price": 2081.41, "symbol": "ETH" },
  "_proof": {
    "call_id":      "ytx_abc123def456",
    "endpoint":     "/v1/price/ETH",
    "payload_hash": "sha256:9f86d081...",
    "timestamp":    1711234567,
    "signer":       "0x41A024c1C89Fd30122c8b184de99cbE751eaC970",
    "signature":    "0x3ad7f1..."
  }
}

The signature proves:

1. The response came from the owner of 0x41A024...
2. The data field hasn't been modified since signing
3. The response was signed at timestamp

API

verify(data, trust, options?)

Verify locally. Returns { valid, signer, signed_at, reason }.

verifyResponse(response, options?)

Verify a full response object with data and _proof fields.

verifyRemote(apiBaseUrl, data, trust)

Verify via the API's own /v1/verify/signature endpoint. Returns a Promise.

canonical(obj)

Serialize an object to canonical JSON (sorted keys, no whitespace).

Options

| Option | Type | Default | Description | |--------|------|---------|-------------| | trustedSigners | string[] | undefined | Allowlist of trusted signer addresses | | maxAgeSeconds | number | 300 | Reject signatures older than this. Set to 0 to disable. |

OpenProof-compliant APIs

• Yantrix Agent Registry
• Yantrix Agent Session
• Yantrix Relay
• Full list at openproof.io/registry

Protocol Spec

SPEC.md

License

MIT