Use signatures

With XMTP, you can use various types of signatures to sign and verify payloads.

Sign with an external wallet

Creating an inbox or adding an installation needs a signature from its identity. Adding an identity needs signatures from that identity and an existing member. Removing an identity or revoking an installation needs the recovery identity’s signature. The SDK asks the signer for these signatures.

Sign with an installation key

The client signs the supplied text with its Ed25519 installation key and the XMTP public signing context. The signature has 64 bytes. This format differs from an Ethereum EOA signature.

Browser

  const signature = await client.signWithInstallationKey(signatureText);

Node

  const signature = await client.signWithInstallationKey(signatureText);

React Native

  const signature = await client.signWithInstallationKey(signatureText);

Kotlin

val signature = client.signWithInstallationKey(signatureText)

Swift

let signature = try await client.signWithInstallationKey(text: signatureText)

Verify with the installation that signed

All five platform SDKs use verifySignedWithInstallationKey. It verifies the text against the current installation key and returns a Boolean.

Browser

  const valid = await client.verifySignedWithInstallationKey(
    signatureText,
    signature,
  );

Node

  const valid = await client.verifySignedWithInstallationKey(
    signatureText,
    signature,
  );

React Native

  const valid = await client.verifySignedWithInstallationKey(
    signatureText,
    signature,
  );

Kotlin

val valid = client.verifySignedWithInstallationKey(signatureText, signature)

Swift

let valid = try await client.verifySignedWithInstallationKey(text: signatureText, signature: signature)

Verify with another installation

Browser, Node, and React Native use static Client.verifySignedWithPublicKey. Kotlin and Swift use static SDKClient.verifySignedWithPublicKey. Pass the installation’s 32-byte public key, not its hex ID string. Browser, Node, and React Native expose the current installation key as client.installationIdBytes.

Verification proves that the matching installation key signed the text. It does not check inbox membership. Check membership separately when the caller must belong to a specific inbox. A wrong text or signature returns false. A signature with a length other than 64 bytes or a public key with a length other than 32 bytes fails with InvalidInput.

Browser

  const valid = await Client.verifySignedWithPublicKey(
    signatureText,
    signature,
    installationPublicKey,
  );

Node

  const valid = await Client.verifySignedWithPublicKey(
    signatureText,
    signature,
    installationPublicKey,
  );

React Native

  const valid = await Client.verifySignedWithPublicKey(
    signatureText,
    signature,
    installationPublicKey,
  );

Kotlin

val valid = SDKClient.verifySignedWithPublicKey(signatureText, signature, installationPublicKey)

Swift

let valid = try await SDKClient.verifySignedWithPublicKey(text: signatureText, signature: signature, publicKey: installationPublicKey)