Verify every number.

Ed25519 · offline-verifiable · no key needed

Every dTAOscan API response is wrapped { data, receipt }. The receipt is an Ed25519 signature over the exact bytes of the data object. So you can prove any number here came from dTAOscan, at that block, unaltered, checked against a published key. A scanner shows you numbers; dTAOscan lets you check them.

The receipt

{
  "data": { ... the payload ... },
  "receipt": {
    "alg": "ed25519",
    "key": "dtaoscan-alpha-1",
    "publicKeyHex": "b1b6314faa1175d3e7852811e8e4a508065683b16b6927091f64938f8edce7c3",
    "payloadSha256": "<sha256 of the data JSON string>",
    "signatureHex": "<ed25519 signature over the data bytes>",
    "signedAt": "<ISO timestamp>"
  }
}

Verify it in four steps

Get the public key

Fetch /keys.json. It publishes the Ed25519 public key (dtaoscan-alpha-1) that signs every response. No account, no key of your own.

Fetch any signed endpoint

e.g. /api/ecosystem. Keep the raw bytes of the data field exactly as sent.

Check the hash

SHA-256 the data JSON string. It must equal receipt.payloadSha256. If it differs, the payload was altered in flight.

Check the signature

Ed25519-verify receipt.signatureHex over the data bytes with the public key. Valid means it is genuinely from dTAOscan and byte-identical to what we signed.

Verify with a script

import { webcrypto as crypto } from "node:crypto";

const res  = await fetch("https://dtaoscan.io/api/ecosystem").then(r => r.json());
const keys = await fetch("https://dtaoscan.io/keys.json").then(r => r.json());

const dataBytes = new TextEncoder().encode(JSON.stringify(res.data));
const pub = await crypto.subtle.importKey(
  "raw", Buffer.from(keys.keys[0].publicKeyHex, "hex"), "Ed25519", false, ["verify"]);
const ok = await crypto.subtle.verify(
  "Ed25519", pub, Buffer.from(res.receipt.signatureHex, "hex"), dataBytes);

console.log(ok ? "VERIFIED" : "TAMPERED");

The key that signs this

the signing key

dtaoscan-alpha-1 is dTAOscan's own key, published at /keys.json and deliberately separate from every other DRM3 key. A dTAOscan receipt vouches for dTAOscan and nothing else.

what a signature proves

That the number came from us, at that block, byte for byte unaltered. It does not make the number correct. It puts our name on it permanently, which is the part you can hold us to.

open alpha

This key is self-published only. It is not yet held in an external keyring, so custody and rotation are ours alone today.

Built for agents → · keys.json · API console