Workloft
A2A v1.0 AP2 V0.1 eddsa-jcs-2022 did:web:workloft.ai Zero-trust

Verify a Workloft credential

Paste any Workloft-issued signed JSON — an A2A Agent Card, an AP2 Intent or Cart Mandate, or any credential carrying our W3C Data Integrity proof — and verify the signature against our public key.

Zero-trust verification. The verification runs entirely in your browser using @noble/ed25519 and canonicalize (RFC 8785 / JCS) from a public CDN. Our public key is fetched from https://workloft.ai/.well-known/did.json. We never see what you paste, and you don’t need our servers up to verify. Open DevTools and read the source if you don’t take our word for it.
Awaiting credential…

How this works (the short version)

  1. You paste a signed credential.
  2. Your browser fetches our DID document at /.well-known/did.json, which contains the Ed25519 public key.
  3. The credential is JCS-canonicalised (RFC 8785), the proof block is canonicalised separately, both are SHA-256’d into a single digest.
  4. The proof value (multibase-base58btc encoded) is decoded and verified against the digest with the public key.
  5. If the signature is valid, the credential is genuinely Workloft-issued and unmodified.

References