5-minute local proof

Issue and verify a record locally.

Generate conformant sample records and verify one offline with the issuer public key. No account, no server. Requires Node 22.13+.

Generate samples

The CLI issues valid signed records and a sandbox JWKS you can verify against.

shell

npx @peac/cli@0.16.3 samples generate -o ./samples

Point the verifier at a record and the sandbox public key. No network needed.

shell

npx @peac/cli@0.16.3 verify ./samples/valid/basic-record.jws \
  --public-key ./samples/bundles/sandbox-jwks.json

Expected: Signature valid (offline).

Change one byte in the record and re-verify; the signature check fails closed.

shell

# edit any byte in basic-record.jws, then re-run verify
# -> E_INVALID_SIGNATURE

The CLI generates these records. Valid ones verify offline; invalid ones demonstrate fail-closed rejection.

valid

basic-record	Minimal valid signed interaction record.
full-record	Valid record with optional fields (subject, declared purpose).
mcp-tool-run	Valid record for an MCP tool run.
payment-event	Valid record for a payment event.
event-time-record	Valid record carrying an event time (occurred_at).

invalid (rejection fixtures)

expired	Already expired.
future-iat	Issuance time in the future (clock-skew violation).
missing-iss	Missing the required issuer claim.

Verify a record in the browser, wire records into an MCP tool, or read the full quickstart and API reference.