> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Introduction
> Enterprise-grade attestation infrastructure for digital credentials.
# Welcome to Truthlocks
Enterprise-grade attestation infrastructure for issuing, managing, and verifying cryptographically signed digital credentials at scale.
## What is Truthlocks?
Truthlocks is a cloud-native platform that enables organizations to issue tamper-proof digital attestations. Whether you're issuing academic credentials, professional certifications, identity verification tokens, or compliance attestations, Truthlocks provides the cryptographic infrastructure to make claims verifiable anywhere, by anyone.
Every attestation is signed with Ed25519 keys and recorded in an append-only
transparency log. Tampering is mathematically impossible.
Issuers are activated immediately on creation and can optionally apply for
higher trust tiers through a review process. Verifiers can trust that
attestations come from legitimate sources.
Verify any attestation in milliseconds with a single API call. Get
cryptographic proof of validity, revocation status, and issuer trust level.
Multi-tenant isolation, RBAC with fine-grained permissions, complete audit
trails, and SOC 2 Type II compliance ready infrastructure.
## Two ways to use Truthlocks
Truthlocks serves both organizations issuing credentials at scale and individual creators proving authorship of their work.
### For organizations (B2B)
Register an issuer, manage signing keys, and mint attestations for credentials like diplomas, certifications, and compliance records. Verifiers can check any attestation with a single API call.
### For individual creators (B2C)
Protect your original content — photos, code, designs, documents — with a single API call. Hash your file client-side, submit the hash, and receive a shareable proof URL. Your signing identity is provisioned automatically on first use.
The [consumer mint endpoint](/api-reference/consumer/mint) returns `content_hash`, `protected_at`, and a `verify_url` in the response, so you can confirm exactly what was protected and share the proof immediately without a follow-up call. Anyone can view the proof page or fetch its metadata via the public [proof metadata endpoint](/api-reference/consumer/proof-metadata) — no authentication required.
Issue your first enterprise attestation in under 5 minutes.
Protect your first file and share a proof link.
## Use cases
Truthlocks is designed for any scenario where you need to issue verifiable claims that third parties can trust without contacting the issuer directly.
### Content protection
* **Creative work:** Prove authorship of photos, designs, music, and video with timestamped cryptographic proofs
* **Source code:** Establish provenance for code files and repositories
* **AI-generated content:** Record provenance metadata for AI outputs
### Education & credentials
* **Academic degrees:** Issue transcripts and diplomas that employers can verify instantly
* **Professional certifications:** AWS, Google Cloud, CFA — all verifiable on-demand
* **Continuing education:** Track and verify CPE credits for licensed professionals
### Identity & access
* **Age verification:** Prove users are 18+ without revealing exact birthdate
* **Employment verification:** Confirm current employment status for background checks
* **KYC/AML attestations:** Share verification status across platforms
### Machine identity
The [Machine Agent Identity Protocol (MAIP)](/guides/machine-identity) is generally available. MAIP gives your AI agents, pipelines, and automated systems a verifiable identity with cryptographic receipts, trust scoring, and a full audit trail.
* **Agent registry:** Register AI agents with unique identifiers and Ed25519 keypairs. Manage the full lifecycle — create, update, suspend, and revoke — via the [agents API](/api-reference/machine-identity/agents/register)
* **Session-based authorization:** Create short-lived, scope-bound sessions with automatic expiry and least-privilege tool access controls. See [agent authorization](/guides/agent-authorization)
* **Trust scores:** Compute continuous 0–100 trust scores based on receipt history, compliance status, and peer attestations. See [trust scores](/guides/trust-scores)
* **AI orchestration:** Coordinate multi-agent tasks using sequential, parallel, hierarchical, or competitive execution patterns with built-in cost tracking and safety guardrails. See [AI orchestration](/guides/ai-orchestration)
* **Cross-tenant delegation:** Offer and accept bilateral trust delegations between tenants with configurable depth limits and receipt chains. See [cross-tenant delegation](/guides/cross-tenant-delegation)
* **Integrations:** Integrations for Slack, GitHub Action, Linear, Notion, VS Code, JetBrains, Neovim, MCP Server, multi-backend event streaming, and AI model connectors for LangChain, LlamaIndex, CrewAI, and more. Browse all available connectors on the [Integrations Hub](https://truthlocks.com/resources/integrations) or see the [MAIP integrations guide](/guides/maip-integrations)
### Anti-fraud & risk
The [Anti-Fraud Identity Firewall](/guides/risk-signals) is generally available. It provides a centralized pipeline for ingesting, normalizing, and querying fraud-detection signals across your identity infrastructure, with real-time [webhook notifications](/guides/webhooks) for all signal types.
* **Risk signal ingestion:** Feed fraud-detection signals from any source — device fingerprinting, IP reputation, email verification, or your own rules — via [`POST /v1/risk/signals`](/api-reference/risk/ingest-signal). Supports idempotent retries and six entity types (`user`, `issuer`, `session`, `device`, `ip`, `attestation`).
* **Event normalization:** Submit raw identity events (failed logins, invalid signatures, deepfake suspects) via [`POST /v1/risk/events`](/api-reference/risk/normalize-event) and have them automatically mapped to risk signals with pre-calibrated scores
* **Risk & Fraud console:** Browse, filter, and inspect all ingested signals with color-coded score badges in the **Risk & Fraud > Signals** console page
* **Deepfake and impersonation detection:** Scan images, videos, documents, and attestations for manipulation indicators via [`POST /v1/risk/deepfake/scan`](/api-reference/risk/deepfake-scan). Scans that exceed the risk threshold automatically create a risk signal. See the [deepfake detection guide](/guides/deepfake-detection)
* **Account takeover detection:** Monitor login velocity per subject and automatically flag account takeover attempts via [`POST /v1/risk/ato/evaluate`](/api-reference/risk/ato-evaluate). The platform tracks failed logins in a rolling one-hour window and creates alerts and risk signals when thresholds are crossed. See the [ATO detection guide](/guides/ato-detection)
* **Velocity and anomaly scoring:** Track action frequency across rolling time windows (1 m, 5 m, 1 h, 24 h) via [`POST /v1/risk/velocity/record`](/api-reference/risk/velocity-record). The platform computes a weighted velocity score biased toward burst detection and auto-ingests risk signals when the score reaches 60 or above. See the [velocity scoring guide](/guides/velocity-scoring)
* **Device fingerprinting:** Track device-level fraud indicators like emulators and spoofed attributes
* **IP reputation scoring:** Flag VPNs, proxies, and datacenter IPs with risk scores
* **Behavioral analysis:** Detect velocity anomalies and suspicious session patterns
### Compliance & governance
* **Regulatory compliance:** Prove compliance with GDPR, HIPAA, SOX
* **Supply chain:** Attest to origin, handling, and quality of goods
* **Financial services:** Issue and verify trade confirmations and settlements
## Architecture Overview
Truthlocks is built as a set of microservices deployed on AWS ECS Fargate, designed for horizontal scalability and high availability.
```text theme={null}
┌─────────────────────────────────────────────────────────────┐
│ API Gateway │
│ (Rate Limiting, Auth, Routing) │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Attestation │ │ Trust │ │ Governance │
│ Service │ │ Registry │ │ Service │
└──────────────┘ └──────────────┘ └──────────────┘
│ │ │
└─────────────────────┼─────────────────────┘
▼
┌──────────────────┐
│ Signing Service │
│ (Ed25519 Keys) │
└──────────────────┘
│
▼
┌──────────────────┐
│ Transparency Log │
│ (Append-only) │
└──────────────────┘
```
## Getting started
Choose the path that matches your use case:
Create an account at [verify.truthlocks.com](https://verify.truthlocks.com).
Upload a file on the Protect page or call the [consumer mint API](/api-reference/consumer/mint). Your signing identity is created automatically.
Use the `verify_url` from the response to share a public proof page that anyone can view without logging in.
Sign up at [console.truthlocks.com](https://console.truthlocks.com) to get
your tenant and API credentials.
Create an issuer profile with your organization details and register your
Ed25519 signing key.
Use the SDK or REST API to create cryptographically signed attestations for
your users or entities.
Share the attestation ID with anyone. They can verify authenticity instantly
using the public verification endpoint.
## Next Steps
Issue your first attestation in under 5 minutes with our step-by-step guide.
Understand tenants, issuers, attestations, and the verification model.
Explore all endpoints with an interactive playground — build requests, switch environments, and send them from the docs.