Offline Verification

Open Preview verifies Receipt V2 tokens online through the SilentAuth API. Offline verification is the production target for local gateways, air-gapped environments, and high-throughput runtimes once public key discovery, key rotation, and revocation lists are finalized.

Current Preview Path

Verify the receipt token against the hosted verifier before your agent executes the protected action:

curl https://api.silentauth.ai/api/intents/permit/verify \
  -H "Authorization: Bearer $SILENTAUTH_PROJECT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "permit_token": "$RECEIPT_TOKEN",
    "action": "production.deploy",
    "parameters": { "environment": "production" }
  }'

The response includes Receipt V2 claims such as params_hash, policy_hash, proof_tier, kid, receipt_version, and expires_at.

Offline Target Shape

The production signer should expose public verification material by key id so agents can verify short-lived receipts without calling the control plane.

GET /api/projects/{projectId}/public-key?kid=signer-2026-06

{
  "kid": "signer-2026-06",
  "algorithm": "EdDSA",
  "public_key": "...",
  "revocation_epoch": 12,
  "expires_at": "2026-07-18T00:00:00.000Z"
}

Gateway Cache Rules

1. Cache public keys by kid and expiry.
2. Reject receipts with expired expires_at values.
3. Reject receipts whose revocation_status is not active.
4. Compare params_hash to the exact action parameters.
5. Refresh revocation lists before accepting offline receipts.