Don't trust. Verify.

Ed25519 · offline-verifiable · no key needed

Every dTAOscan API response is wrapped { data, receipt }. The receipt is an Ed25519 signature over the exact bytes of the data object. So you can prove any number here came from dTAOscan, at that block, unaltered, without trusting the connection or us. This is the difference between a scanner that says "trust me" and one that hands you proof.

The receipt

{
  "data": { ... the payload ... },
  "receipt": {
    "alg": "ed25519",
    "key": "dtaoscan-alpha-1",
    "publicKeyHex": "b1b6314faa1175d3e7852811e8e4a508065683b16b6927091f64938f8edce7c3",
    "payloadSha256": "<sha256 of the data JSON string>",
    "signatureHex": "<ed25519 signature over the data bytes>",
    "signedAt": "<ISO timestamp>"
  }
}

Verify it in four steps

Get the public key

Fetch /keys.json. It publishes the Ed25519 public key (dtaoscan-alpha-1) that signs every response. No account, no key of your own.

Fetch any signed endpoint

e.g. /api/ecosystem. Keep the raw bytes of the data field exactly as sent.

Check the hash

SHA-256 the data JSON string. It must equal receipt.payloadSha256. If it differs, the payload was altered in flight.

Check the signature

Ed25519-verify receipt.signatureHex over the data bytes with the public key. Valid means it is genuinely from dTAOscan and byte-identical to what we signed.

Verify with a script

import { webcrypto as crypto } from "node:crypto";

const res  = await fetch("https://dtaoscan.io/api/ecosystem").then(r => r.json());
const keys = await fetch("https://dtaoscan.io/keys.json").then(r => r.json());

const dataBytes = new TextEncoder().encode(JSON.stringify(res.data));
const pub = await crypto.subtle.importKey(
  "raw", Buffer.from(keys.keys[0].publicKeyHex, "hex"), "Ed25519", false, ["verify"]);
const ok = await crypto.subtle.verify(
  "Ed25519", pub, Buffer.from(res.receipt.signatureHex, "hex"), dataBytes);

console.log(ok ? "VERIFIED" : "TAMPERED");

How it is signed

dTAOscan signs with native Web Crypto Ed25519 inside the Cloudflare Worker, the same pattern the DRM3 lakehouse and MorScan Workers use. (The @drm3/provenance package is a Rust/WASM library for Node contexts; a Worker signs natively.) The signing key dtaoscan-alpha-1 is dTAOscan's own, self-published at /keys.json and independent of every other DRM3 key by design, so a dTAOscan receipt vouches for dTAOscan and nothing else. Alpha posture: the key is not yet in an external keyring.

Built for agents → · keys.json · API console