Verify a render receipt

Every render response carries a signed receipt. Paste one here to check it was issued by pagenull and, optionally, that a file is the exact output it describes.

ReceiptThe value of the pagenull-receipt response header.The file (optional)Hashed in your browser to check it’s the exact output the receipt describes. It isn’t uploaded.

What a receipt proves, and what it doesn’t

A receipt is an Ed25519 signature over the render id, the SHA-256 of the output, the time, the region, the renderer image digest and stored: false. It proves that we produced exactly that file, then, there, with that renderer, and that the API didn’t keep it.

It does not prove deletion. Nothing can prove a negative from the outside. That claim rests on the architecture (there is no code path that writes request content or output; a test enforces it), the renderer running with a read-only filesystem, and our data processing agreement. The details are on trust.

From the command line

Terminal

# Save the header and the file, then verify both against our published key
curl -sD headers.txt https://api.pagenull.dev/v1/pdf -H "Authorization: Bearer $PAGENULL_API_KEY" \
  -H "Content-Type: application/json" -d '{"html":"<h1>Hi</h1>"}' -o out.pdf
pnpm verify-receipt "$(grep -i '^pagenull-receipt:' headers.txt | cut -d' ' -f2 | tr -d '\r')" out.pdf

The public key is at /.well-known/pagenull-keys.json (JWK set). Any Ed25519 library can check the signature: the signed bytes are the second dot-separated part of the receipt, exactly as sent.