← Back to explorer

Provenance · Ed25519 · Checked in your browser

Verify a response

Every API response MorScan serves is signed. This page takes one live response and walks through the check, step by step, in front of you. The math runs in your own browser: MorScan's server is not part of the verdict.

Pick what to verify

Free endpoints like /mor/v1/price and /version need no key. Metered endpoints answer 402 without one; paste their body here instead, or use an API key.

The check, live

  1. We fetched this API response from morscan.io
  2. The response came with a signature
  3. We fetched MorScan's published public key
  4. Your browser is checking the math right now
  5. Verdict

What this adds is accountability, not a reason to skip trust. MorScan put its name (a published key) on this response, and your own browser just confirmed that signature is genuinely MorScan's and unchanged since it was signed. It proves who stands behind these numbers and that they are unaltered, not that they are correct: a signature can be placed on a wrong value too. If the signed attestation had been altered after signing, this check would fail.

Who signed it

MorScan derives two Ed25519 signing keys: morscan/cache for indexed on-chain data and morscan/signer for service-level attestations. Both public keys, with their full rotation history and validity windows, are published at /.well-known/morscan-keys.json. The operator behind those keys is DRM3 Labs, whose signing-key lineage across all its services lives in the public registry at drm3.io/signers.

What it means

This is MorScan putting its name on its numbers, permanently and checkably. Every response carries the receipt with it, the keys are public, and the check is pure math anyone can run: this page in a browser, or the same ~50-line verifier from the command line: npm run verify:receipt in the public repo. What it gives you is attribution you can confirm and tamper-evidence on what was signed: added accountability. Our name is on every number, and we cannot quietly change it later. Machine-readable build identity stays at /version, and the full receipt design is documented in the repo's provenance docs.