Payload signing

Sign an audit event with the agent private key at source, so a record that has been edited after the fact stops verifying against the registered public key.

Payload Signing

Sign payloads with the agent's private key for tamper-proof verification.

Signing is on by default, and that default only does anything when the SDK holds the agent's private key. register() puts the key in an in-process keyring, and useAgentKey() restores it after a restart. Emit an event for an agent whose key is missing and it goes out unsigned, with nothing raised to tell you.

Design against that one. A pipeline can look healthy while writing unsigned rows for months, and the only check that exercises the whole path is exporting a bundle and running @vorim/verify over it.

What gets signed is a canonical serialization of the event rather than the JSON you happened to send, so two services that order their fields differently still produce identical bytes. v1 follows RFC 8785 and is the default. v0 stays readable for anything signed before that change, since re-signing an old event would defeat the point of having signed it.

Vorim never holds the private key. It is returned once, when the agent is registered, and never again, so a lost key means rotating the agent rather than recovering it.

vorim.sign(payload, privateKeyPem)

// Sign a payload with the agent's private key
const payload = JSON.stringify({ action: 'transfer', amount: 500 });
const signature = await vorim.sign(payload, agent.private_key);

console.log(signature);
// 'ed25519:base64encodedSignature...'

// Include signature in audit events for verification
await vorim.emit({
  agent_id: agent.agent_id,
  event_type: 'api_request',
  action: 'POST /transfers',
  result: 'success',
  signature,  // Stored with the audit event
});

typescript

Need Help?

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.