Signed API responses and Ed25519 verification

How do signed API responses work?

Add sign=true to a supported JSON route for signed API responses. TimeLogic API leaves the JSON body unchanged and returns headers containing the key id, algorithm, timestamp, body hash, signing input, and Ed25519 signature.

Verify the exact response bytes locally against the public key from /.well-known/timelogic-keys.json; this is the Ed25519 API response verification workflow. The browser signed-response verifier helps inspect a response without sending it to a third party.

Verification workflow

1. Request the public key registry from /.well-known/timelogic-keys.json and select the key named by the response's key-id header.
2. Preserve the exact response body bytes. Do not parse and re-serialize JSON before verifying.
3. Reconstruct the documented signing input from the response headers and body hash.
4. Verify the Ed25519 signature with the public key, then process the JSON.

The browser signed-response verifier helps inspect a response without sending it to a third party. For a service integration, use an Ed25519 library in your server language and keep the public key registry refreshable so key rotation can be handled.

Signing is supported for current time, conversion, difference, add, calendar, DST, elapsed, and timezone JSON routes. /v1/time/clock does not support signing. Read the full signed responses documentation.