Skip to content
Portproof
Get proxies

Rotation log

Verify a rotation record

Every rotation on our own network writes a record signed on the device with a per-site Ed25519 key. Paste one here; this page canonicalises it (keys sorted, no whitespace, sig omitted) and checks the signature in your browser against the public key directory.

Paste the body returned by POST /v1/ports/{id}/rotate, GET /v1/receipts/{id} or any entry from a port's rotation log. Verification runs in this tab; nothing is uploaded.

Verify against a key you supply
Loading signing keys…

How verification works

  1. Fetch /.well-known/portproof-keys.json; it lists key_id, site, algorithm, the raw public key (base64) and the validity window. Keys are per site and rotate yearly; key_id is <site>-<year>.
  2. Remove sig, sort every object key recursively, serialise without whitespace as UTF-8. That is the canonical form the agent signed.
  3. Verify the base64 sig over the canonical bytes with Ed25519. The same function is exported as verifyReceipt from @portproof/shared for servers and CI.

A verified record with rotated: false is still a valid record: it says the carrier handed back the same address after the stated attempts and the port owner is owed the credit, not that the signature is wrong. Records from partner networks are written by our monitoring and carry the control-plane key.