Build SigWave into your systems.
Ask a person a question from your own system, get back an answer signed on their own device, and check that signature yourself. You keep the answer and a receipt, never the document behind it. This page is for the engineers doing the building.
A mark is a public identity that only its owner can answer for
A person or an organization makes a mark on a device they hold. The secret behind it is made on that device and never leaves it, and the mark's code is tied to that secret, so a copied mark can't answer for anyone. Seeing a mark grants nothing: it is an address you can ask, not a credential you can use.
Each mark has a list of the devices allowed to answer for it. A new device is added from one the owner already holds; a lost one is removed in one step. Anyone checking an answer can check that list too.
You ask; they answer on their own device
Your system asks a person a question, signed by your own mark. There are four kinds.
The person sees who is asking ("Calls itself" your name) and exactly what you want, and answers after Face ID, Touch ID or their Mac's password. The answer comes back signed, and you can check that signature yourself. Both sides keep receipts of every question and answer.
Signed documents
A signer signs a PDF on their phone. The page carries their mark and a document code, and anyone can check a printed page at sigwave.id/scan. The verdict is one word: Signed, Changed or Not signed.
Everything else you carry works for whoever holds it.
A mark only works for its owner.
Ask from the browser
An organization asks from sigwave.id/ask and reads the answer on the same page as it arrives. A written guide for building the ask into your own system is on the way; until then, talk to us and we will walk you through what exists.
Verify without calling us
A verification library (Rust today) checks a mark, its device list and a signed record without calling sigwave.id. It is in use inside Synap and not yet offered outside; Swift and JavaScript versions follow. It needs no database and no network.
Payments that work once
A store asks to be paid: this store, this amount, this once. The customer approves on their phone, and the money moves over the card network the store already uses. The store never sees or keeps a card number. SDKs shaped the way payment developers already work, with test and live modes, idempotency and signed webhooks, will come with it.
A mark that proves it is your organization
Today an organization's mark reads "Calls itself X", the same as anyone's. We are building the way to prove a mark belongs to your organization, so a scam that calls itself you fails the check.
Security
Security-critical designs get a security read, and every deploy passes a gate of dependency audits, type checks, an attack suite and a seeded fuzz of every route, run against a local copy. More at Security.