Quickstarts

Each quickstart takes one request to a verified, signed receipt, using only standard cryptography. Pick your runtime. The code on these pages is the same code CI runs.

QuickstartCloudflare Workers

Node 20 or later. Wrangler is fetched by npx; no Cloudflare account is needed to run it locally.

QuickstartNode

Node 20 or later. No packages.

QuickstartPython

Python 3.9 or later, and the cryptography package for Ed25519.

QuickstartGo

Go 1.22 or later. Standard library only.

What you will have at the end

Output like this, recorded from the Node quickstart against the live API: REPLAY recorded 2026-11-07

Output

receipt: b8d4f2ceb697b3904d50459c649d6fc220418387d87332d04ab47cf2bd32fa98
outcome: allow (rule allow.default)
key: edge-receipt
verified: true
tampered copy verifies: false
evidence grade: rung 2 Operational, confidence none, uncalibrated (assigned by the docs, not a signed field)

Decide. POST /v1/check ran the request shape through the public policy for tenant try and returned the outcome, the rule and a signed receipt.
Fetch the keys. GET /.well-known/jwks.json returned the public Ed25519 keys.
Verify. The script rebuilt the canonical JSON of the receipt body and checked the signature with the one key whose kid equals the receipt's agent_kid. It never tries the other published keys: they sign other things, such as sessions, so a receipt that verifies under one of them is not a valid receipt.
Tamper. It flipped the outcome and checked again. The signature no longer holds, which is the point of a receipt.

The evidence grade of this receipt

A receipt is a rung 2 record: it shows which rule decided and that the record was not changed. It does not, by itself, say whether the sender was an AI agent.

Evidence grade Rung 2 · Operational

Covers

Which rule decided this request and that the record was not changed after signing. Not whether the sender was an AI agent.

Confidence

None stated. No calibrated confidence applies to this record.

Calibration

Uncalibrated

Known error rates

None measured. Silvector publishes no detection error rate yet.

Basis

Deterministic decide() rule allow.default
Ed25519 signature over the canonical receipt body, checked against the published JWKS

Bias risks

The decision is only as good as the facts it was given. A request with no signature claim is not_identified, which is not a finding that a person or an agent sent it.

Next step

To ask who was behind a series of requests, keep the receipts and escalate to rung 3 with at least two independent signal families. How escalation works

Assigned by

These docs, from the rung definitions. The grade is not a signed field of the receipt.

How we keep them working

The docs CI job starts the API from this repository and runs all four quickstarts three ways through a server it controls. Against the API, it checks that each quickstart printed the receipt the API issued and verifies that receipt itself. Against a receipt it signs with the API's own canonicalizer, holding values JSON encoders disagree on, each quickstart must verify. Against a receipt signed by the wrong published key, each must refuse. Any failure fails the build.

No account, key or sign-up is needed. The public check endpoint allows 60 requests a minute per caller.