> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Quick Start
> Issue your first attestation in under 5 minutes.
This guide walks you through issuing your first cryptographically signed attestation using the Truthlocks API. By the end, you'll have a verifiable credential that anyone can validate.
**Individual creator?** If you want to protect a file (photo, code, design) rather than issue enterprise credentials, use the [content protection guide](/guides/content-protection) instead. You can protect content with a single API call — no issuer setup required.
**Prerequisites:** You need a Truthlocks account and API key. Sign up at
[console.truthlocks.com](https://console.truthlocks.com) if you haven't
already.
**Prefer a visual approach?** Every API endpoint in the [API reference](/api-reference/attestations/mint) has an interactive playground where you can build requests, switch between [Sandbox and Production](/environments#try-it-in-the-api-playground) environments, and send them directly from the docs.
**Looking for SDKs or CLI tools?** The [Downloads](https://truthlocks.com/resources/downloads) page collects the CLI, SDKs, IDE plugins, and Docker images with copy-to-clipboard install commands.
Navigate to the **API Keys** section in your console dashboard. Create a new API key with the following scopes:
* `issuers:read` - View your issuers
* `issuers:write` - Create and manage issuers
* `attestations:mint` - Create new attestations
**Security:** Your API key secret is only shown once. Store it securely in a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.). Never commit API keys to version control.
Your API key will look like:
```txt theme={null}
tl_live_abc123def456gh789ijklmnopqrstuv
```
All endpoints accept both `X-API-Key: ` and `Authorization: ApiKey ` headers. Use whichever fits your HTTP client. See [authentication](/security/auth#passing-your-key) for details.
Issuers are entities that can sign attestations. Each issuer has a unique identity, cryptographic keys, and a trust status. Create your first issuer:
```bash Request theme={null}
curl -X POST https://api.truthlocks.com/v1/issuers \
-H "Content-Type: application/json" \
-H "X-API-Key: tl_live_your_api_key" \
-d '{
"name": "Acme University",
"domain": "acme.edu"
}'
```
```json Response (201 Created) theme={null}
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"name": "Acme University",
"domain": "acme.edu",
"status": "ACTIVE",
"trust_level": "BASIC",
"created_at": "2026-01-13T12:00:00Z"
}
```
**Note:** New issuers are activated immediately upon creation. You can start minting attestations right away without waiting for manual approval. If your organization needs a higher trust tier, you can submit an [issuer application](/guides/issuer-applications) for review.
Every issuer needs at least one signing key (Ed25519 recommended; ES256, ES384, RS256, PS256 also supported). You can generate keys locally or use our SDK to create them.
```javascript Generate a Key Pair (Node.js) theme={null}
import { generateKeyPair } from 'crypto';
generateKeyPair('ed25519', (err, publicKey, privateKey) => {
console.log('Public Key (PEM):', publicKey.export({ type: 'spki', format: 'pem' }));
console.log('Private Key (PEM):', privateKey.export({ type: 'pkcs8', format: 'pem' }));
});
```
```bash Register the Public Key theme={null}
curl -X POST https://api.truthlocks.com/v1/issuers/550e8400-e29b-41d4-a716-446655440000/keys \
-H "Content-Type: application/json" \
-H "X-API-Key: tl_live_your_api_key" \
-d '{
"kid": "ed-key-2026",
"algorithm": "Ed25519",
"public_key": "MCowBQYDK2VwAyEAGb9Y2LvOsSglb2wUInSMKDpXm1QL..."
}'
```
**Critical:** Never share or upload private keys to Truthlocks. Only the public key is registered. Keep private keys in secure hardware (HSM) or a secrets manager.
Now you can create your first attestation. This example issues a verified email claim for a user:
```bash Request theme={null}
curl -X POST https://api.truthlocks.com/v1/attestations/mint \
-H "Content-Type: application/json" \
-H "X-API-Key: tl_live_your_api_key" \
-d '{
"issuer_id": "550e8400-e29b-41d4-a716-446655440000",
"kid": "ed-key-2026",
"subject": "user:john.doe@example.com",
"claim": "email_verified",
"value": "john.doe@example.com",
"metadata": {
"verified_at": "2026-01-13T12:00:00Z",
"verification_method": "otp"
}
}'
```
```json Response (201 Created) theme={null}
{
"id": "660e8400-e29b-41d4-a716-446655440001",
"issuer_id": "550e8400-e29b-41d4-a716-446655440000",
"kid": "ed-key-2026",
"status": "VALID",
"payload": {
"subject": "user:john.doe@example.com",
"claim": "email_verified",
"value": "john.doe@example.com"
},
"signature": "MEUCIQDf7KxF5bXmz...",
"log_index": 42,
"created_at": "2026-01-13T12:05:00Z"
}
```
**Congratulations!** You've just issued a cryptographically signed attestation. The `log_index` is its position in the transparency log, providing proof of when it was created.
Anyone can verify your attestation using its ID. The verification endpoint is public and requires no authentication:
```bash Request theme={null}
curl -X POST https://api.truthlocks.com/v1/verify \
-H "Content-Type: application/json" \
-d '{
"attestation_id": "660e8400-e29b-41d4-a716-446655440001"
}'
```
```json Response (200 OK - Valid) theme={null}
{
"verdict": "VALID",
"valid": true,
"details": {
"issuer_id": "550e8400-e29b-41d4-a716-446655440000",
"issuer_name": "Acme University",
"issuer_domain": "acme.edu",
"issuer_trust_level": "VERIFIED",
"log_index": 42,
"created_at": "2026-01-13T12:05:00Z",
"checked_at": "2026-01-13T12:10:00Z"
}
}
```
## Understanding Verdicts
The verification endpoint returns one of five verdicts:
| Verdict | Valid | Meaning |
| ------------ | ------- | --------------------------------------------------------------------------------------------- |
| `VALID` | ✅ true | Signature valid, issuer trusted, not revoked or superseded |
| `REVOKED` | ❌ false | Was valid but has been revoked by issuer |
| `SUPERSEDED` | ❌ false | Was valid but has been [superseded](/api-reference/attestations/supersede) by a newer version |
| `ALTERED` | ❌ false | Payload doesn't match signature (tampering detected) |
| `UNKNOWN` | ❌ false | Attestation ID not found in system |
## Next Steps
Deep dive into tenants, issuers, trust levels, and the governance model.
Production-ready code patterns in JavaScript, Go, Python and more.
Learn about API keys, JWT tokens, and security best practices.
Ingest fraud-detection signals and normalize identity events into your risk pipeline.
Connect MAIP to Slack, GitHub, VS Code, AI frameworks, and more.