Skip to content

Signatures

Protocol

Signatures

Ed25519 over the hex SHA-256 digest of the canonical payload. Keys are published in JWKS.

Algorithm

signature.alg is ed25519. signature.key_id currently receipt-ed25519-v1. signature.value is base64.

JWKS

GET /.well-known/jwks.json publishes OKP / Ed25519 keys with kid, use: sig, and a PEM. Verification selects the key whose kid matches signature.key_id. Unknown kid is a failure.

Payload relationship

  1. Canonicalize the unsigned body.
  2. SHA-256 → hex string stored in hashes.canonical_payload_sha256.
  3. Sign those hex UTF-8 bytes with Ed25519.

What a valid signature proves

  • Integrity of the signed payload.
  • Authorship by a Fiscal402 signing key published in JWKS.
  • Binding to that canonical payload hash.

What it does not prove

  • Tax-authority acceptance.
  • Legal correctness of the determination.
  • Legal identity of a wallet.
  • Complete regulatory compliance.