Egregor Developers
The Verification API
Integrate professional-grade document verification into your platform. The Egregor Verification API allows you to programmatically check cryptographic signatures created via our Secure Enclave chip technology, ensuring tamper-proof document integrity for your enterprise workflows.
Secure Enclave
Utilize hardware-level security for every document verification request.
Instant Verify
Real-time confirmation of signature validity and official timestamps.
Privacy First
Verify signatures using only SHA-256 hashes without ever exposing original file data.
QUICK START
Quick start
Base URL: https://digitalsignatureapp-production.up.railway.app
Get a free API key
curl -s -X POST https://digitalsignatureapp-production.up.railway.app/v1/keys \
-H "Content-Type: application/json" \
-d '{"email":"you@company.com","label":"My app","accept_terms":true}'
Copy the api_key value from the response. It is shown only once. Sending "accept_terms": true means you accept the API Terms. Limits: up to 3 active keys per email, and up to 5 new keys per day from one network.
Hash the file
shasum -a 256 contract.pdf
Ask the API
curl -s "https://digitalsignatureapp-production.up.railway.app/v1/verify?username=alice&sha256=<64-hex-hash>" \
-H "Authorization: Bearer <your api key>"
Response:
{"signature_valid": true, "signed_at": "2026-10-26T18:11:30+00:00"}
THE RESPONSE
Reading the answer
Field
Meaning
signature_valid
true only if that user signed that exact file and the signature checks out.
signed_at
When the signature was registered, in UTC (ISO 8601). Empty (null) when signature_valid is false.
A "false" is the same answer for every "no": the username doesn't exist, the file was never signed, someone else signed it, or the file was changed after signing. By design the API never says which, so it can't be used to discover usernames or who signed a file.
Same bytes, same hash. Hash the file exactly as you received it. Re-saving, converting or compressing a file (for example, a photo re-sent through a messaging app) changes its bytes, and the answer will be false.
IMPLEMENTATION
Code examples
Keep your key in an environment variable such as EGREGOR_API_KEY, never in source code.
Python
import hashlib, os, requests BASE = "https://digitalsignatureapp-production.up.railway.app" def sha256_file(path): h = hashlib.sha256() with open(path, "rb") as f: for chunk in iter(lambda: f.read(1024 * 1024), b""): h.update(chunk) return h.hexdigest() def verify(username, path): r = requests.get( f"{BASE}/v1/verify", params={"username": username, "sha256": sha256_file(path)}, headers={"Authorization": f"Bearer {os.environ['EGREGOR_API_KEY']}"}, timeout=10, ) r.raise_for_status() return r.json() print(verify("alice", "contract.pdf"))
JavaScript (Node.js 18+)
import { createHash } from "node:crypto"; import { createReadStream } from "node:fs"; const BASE = "https://digitalsignatureapp-production.up.railway.app"; function sha256File(path) { return new Promise((resolve, reject) => { const h = createHash("sha256"); createReadStream(path) .on("data", (chunk) => h.update(chunk)) .on("end", () => resolve(h.digest("hex"))) .on("error", reject); }); } export async function verify(username, path) { const url = new URL("/v1/verify", BASE); url.searchParams.set("username", username); url.searchParams.set("sha256", await sha256File(path)); const res = await fetch(url, { headers: { Authorization: `Bearer ${process.env.EGREGOR_API_KEY}` }, }); if (!res.ok) throw new Error(`${res.status}: ${(await res.json()).detail}`); return res.json(); }
PHP
<?php$base = "https://digitalsignatureapp-production.up.railway.app";$hash = hash_file("sha256", "contract.pdf");$url = $base . "/v1/verify?" . http_build_query(["username" => "alice", "sha256" => $hash]);$ch = curl_init($url);curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPHEADER => ["Authorization: Bearer " . getenv("EGREGOR_API_KEY")],]);$result = json_decode(curl_exec($ch), true);curl_close($ch);var_dump($result["signature_valid"], $result["signed_at"]);
Status
When
What to do
400
The hash isn't 64 hexadecimal characters, or a key request is missing the terms acceptance or a valid email
Fix the request.
401
The API key is missing, wrong or revoked
Check the Authorization header, or create a new key.
422
A required parameter is missing
Send both username and sha256.
429
Monthly quota used up, or too many keys created from one network today
Wait for the reset on the 1st of the month (UTC), or contact us for a higher quota.
5xx
Temporary server problem
Retry after 1, 2, then 4 seconds.
Errors and Limits
Errors and limits
Errors return JSON with a "detail" message. A false verification is not an error: it is a normal 200 response with signature_valid: false.
Check your usage at any time with GET /v1/usage (free, doesn't count against the quota). If a key leaks, revoke it with DELETE /v1/keys/current and create a new one.
SECURITY AND PRIVACY
Security and privacy
Call the API from your server, not from a browser or a published app. Anyone who sees your key can use your quota.
Keep your key secret: store it in an environment variable or a secrets manager. Never put it in a repository or in logs.
Your files never leave your system. You send only the SHA-256 hash, which can't be turned back into the file.
The API never returns names, ID numbers, emails, devices or any other personal information about the signer.