Use signatures

With XMTP, you can use various types of signatures to sign and verify payloads.

Sign with an external wallet

Creating an inbox or adding an installation needs a signature from its identity. Adding an identity needs signatures from that identity and an existing member. Removing an identity or revoking an installation needs the recovery identity’s signature. The SDK asks the signer for these signatures.

Sign with an installation key

The client signs the supplied text with its Ed25519 installation key and the XMTP public signing context. The signature has 64 bytes. This format differs from an Ethereum EOA signature.

  const 
const signature: Uint8Array<ArrayBufferLike>
signature = await 
client: Client
client.
ClientMembers.signWithInstallationKey(text: string): Promise<Uint8Array>
signWithInstallationKey(
signatureText: string
signatureText);

  const 
const signature: Uint8Array<ArrayBufferLike>
signature = await 
client: Client
client.
ClientMembers.signWithInstallationKey(text: string): Promise<Uint8Array>
signWithInstallationKey(
signatureText: string
signatureText);

val signature = client.signWithInstallationKey(signatureText)

let signature = try await client.signWithInstallationKey(text: signatureText)

Verify with the installation that signed

All four SDKs use verifySignedWithInstallationKey. It verifies the text against the current installation key and returns a Boolean.

  const 
const valid: boolean
valid = await 
client: Client
client.
ClientMembers.verifySignedWithInstallationKey(text: string, signature: Uint8Array): Promise<boolean>
verifySignedWithInstallationKey(
    
signatureText: string
signatureText,
    
signature: Uint8Array<ArrayBufferLike>
signature,
  );

  const 
const valid: boolean
valid = await 
client: Client
client.
ClientMembers.verifySignedWithInstallationKey(text: string, signature: Uint8Array): Promise<boolean>
verifySignedWithInstallationKey(
    
signatureText: string
signatureText,
    
signature: Uint8Array<ArrayBufferLike>
signature,
  );

val valid = client.verifySignedWithInstallationKey(signatureText, signature)

let valid = try await client.verifySignedWithInstallationKey(text: signatureText, signature: signature)

Verify with another installation

Browser and Node use static Client.verifySignedWithPublicKey. Kotlin and Swift use static SDKClient.verifySignedWithPublicKey. Pass the installation’s 32-byte public key, not its hex ID string. Browser and Node expose the current installation key as client.installationIdBytes.

Verification proves that the matching installation key signed the text. It does not check inbox membership. Check membership separately when the caller must belong to a specific inbox. A wrong text or signature returns false. A signature with a length other than 64 bytes or a public key with a length other than 32 bytes fails with InvalidInput.

  const 
const valid: boolean
valid = await 
class Client
An XMTP client. Its inputs and results are public values; the binding
Client and the target transport stay private to the package.
Client.
ClientMembers.verifySignedWithPublicKey(text: string, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>
verifySignedWithPublicKey(
    
signatureText: string
signatureText,
    
signature: Uint8Array<ArrayBufferLike>
signature,
    
installationPublicKey: Uint8Array<ArrayBufferLike>
installationPublicKey,
  );

  const 
const valid: boolean
valid = await 
class Client
An XMTP client. Its inputs and results are public values; the binding
Client and the target transport stay private to the package.
Client.
ClientMembers.verifySignedWithPublicKey(text: string, signature: Uint8Array, publicKey: Uint8Array): Promise<boolean>
verifySignedWithPublicKey(
    
signatureText: string
signatureText,
    
signature: Uint8Array<ArrayBufferLike>
signature,
    
installationPublicKey: Uint8Array<ArrayBufferLike>
installationPublicKey,
  );

val valid = SDKClient.verifySignedWithPublicKey(signatureText, signature, installationPublicKey)

let valid = try await SDKClient.verifySignedWithPublicKey(text: signatureText, signature: signature, publicKey: installationPublicKey)