Skip to main content

Quickstart

Verify a signed asset locally in a few lines. See the Overview for why this needs no network call.

npm types runtime: Browser and Node.js

Install​

npm install @limboai/verifox-sdk-verifier

The package ships a WebAssembly module, so a plain ESM import is all you need — it loads and initializes automatically at import time, with no build configuration or manual setup.

Verify a file​

import { AssetSdk, DEV_CA } from '@limboai/verifox-sdk-verifier';

const verifier = AssetSdk.create({ trustAnchors: [DEV_CA()] });

const response = await fetch('/photos/cover.jpg');
const bytes = new Uint8Array(await response.arrayBuffer());

const [credential] = await verifier.verify(bytes, []);

const store = credential?.manifest;
const manifest = store?.active_manifest
  ? store.manifests![store.active_manifest]
  : undefined;
console.log(manifest?.claim_generator, store?.validation_state);

verify(input, binders) returns an array of credentials (one for an embedded manifest, several when recovered from a configured registry, empty when unsigned), so take the first for the common case. The [] second argument is the list of recovery binders — none here; pass e.g. [Binder.iscc()] to recover a stripped or re-encoded asset (see Recovery). Each entry pairs the manifest store with the binding that located it — null when the manifest was embedded, { kind: 'hard', hash } for an exact-hash match, or { kind: 'soft', alg, value } for a durable recovery. The handle is garbage-collected automatically, so you don't release it manually.

DEV_CA() is dev-only

DEV_CA() is a shared development anchor with no security guarantees: anyone can sign content it will trust. Do not ship it in a release build. Replace it with the production anchors in Trust anchors.

Inspect the result​

Each credential's manifest store carries the fields needed to render a verified-content badge:

  • manifest.active_manifest: label of the most recent signature; undefined indicates an unsigned asset.
  • manifest.manifests![active_manifest].claim_generator: signer name.
  • manifest.manifests![active_manifest].signature_info?.time: signing timestamp.
  • manifest.validation_state: 'Trusted', 'Valid', or 'Invalid'. Drives badge color.
  • binding: how the manifest was located — null when embedded, or a hard/soft binding when recovered from the registry.

Next steps​