Skip to main content
An attestation signs a payload and records its hash. Verification checks cryptographic integrity and record status; it does not independently establish that the issuer’s claims are true.

Before you start

In Console, select your workspace and environment. Obtain an API key, issuer ID, and an active key available for server-side signing. Use the algorithm shown for that key. Registering a public key alone does not give the signing service its private key. Use https://sandbox-api.truthlocks.com with a sandbox key (tl_test_). Use https://api.truthlocks.com with a production key (tl_live_) and an approved workspace. Resources and credentials must belong to the same environment. Do not send X-Tenant-ID to choose a workspace: it is derived from your credentials.

Mint a record

This example uses Python 3’s standard library. Set the four required environment variables through your shell or secret manager. Set TRUTHLOCKS_BASE_URL only if changing from sandbox to production.
HTTP errors raise urllib.error.HTTPError. Handle errors and timeouts in your application; preserve the same idempotency key and body when retrying an uncertain mint outcome. The response uses attestation_id, issued_at_unix, signature, and log. It does not echo the claims as a top-level payload. Keep the original bytes for subsequent integrity checks.

Verify the result

Use the verification reference with the returned attestation_id. Supply payload_b64url to check the exact original bytes, or document_hash_hex to compare a file hash. Inspect verdict and reasons: a successful HTTP response alone does not mean the record is valid.

Troubleshooting

  • 401 or 403: check credentials, environment, permissions, and workspace approval.
  • 400: check UUIDs, the idempotency header, and unpadded base64url encoding.
  • Key or policy error: confirm the issuer and key are usable for signing and the algorithm matches.
  • Timeout: retry with the original body and idempotency key, rather than creating a new mint.
Continue with mint parameters, authentication, and environments.