ClearRun signed receipts
What a signed receipt proves, and how to check one later.
Last updated
Start here
What does signed and receipted mean?
Each successful hosted ClearRun call is Ed25519-signed and returns a receipt. You can look the receipt up later, with no API key. It shows ClearRun issued that score. It does not show the answer is true.
How to verify a ClearRun receipt
Look up a verdict id at api.clearrun.net/api/verify/{id}. No API key needed. It confirms ClearRun issued that score. It does not check whether the answer is true.
All Signed receipts and audit articles
What does signed and receipted mean?
Each successful hosted ClearRun call is Ed25519-signed and returns a receipt. You can look the receipt up later, with no API key. It shows ClearRun issued that score. It does not show the answer is true.
How to verify a ClearRun receipt
Look up a verdict id at api.clearrun.net/api/verify/{id}. No API key needed. It confirms ClearRun issued that score. It does not check whether the answer is true.
What does a ClearRun receipt prove, and what doesn't it?
A receipt proves ClearRun issued a specific verdict for specific input and output, at a specific time, and lets anyone check whether it has changed since.
Does a verified receipt mean the AI answer is true?
No. Verified means the receipt is real and unchanged: ClearRun issued that score for that text. It says nothing about whether the answer is true. ClearRun help.
Which ClearRun scores are signed?
Every successful hosted score, evaluate and chat call is signed and gets a receipt. Mock mode scores are never signed. Read more in the ClearRun help center.
Are mock verdicts signed?
No. ClearRun mock verdicts are never signed and have no receipt. Their signature, signatureKeyId and signatureAlg are null, and their ids start with mock_.
How to check a ClearRun receipt signature yourself
Check a ClearRun receipt yourself: fetch it and the public keys, then verify the Ed25519 signature over its 11 signed fields. A Node.js script is inside.
Which fields does the receipt signature cover?
Eleven: alg, encKeyId, inputHash, keyId, outputHash, prevHash, receiptId, timestamp, verdictHash, verdictId and workspaceId. From the ClearRun help center.
What is the ClearRun receipt hash chain?
Each ClearRun receipt stores the hash of the one before it in the same workspace, in prevHash, so changing or removing one breaks the chain. More inside.
What time is on a ClearRun receipt?
receipt.timestamp is the time ClearRun issued the receipt, from ClearRun's server clock, in ISO 8601 UTC. A plain answer from the ClearRun help center.
What does receipt status 'queued' mean?
queued means ClearRun signed your verdict but could not save the receipt right away, so it was put in a queue and retried. From the ClearRun help center.
Why can't I check verdict.signature myself?
verdict.signature covers data that is not in the public response, so you can't rebuild what was signed. Check the receipt instead. ClearRun help center.
What does the public verify link show?
A ClearRun verify link shows whether the verdict verified, the receipt hashes and time, and the public score, summary and issues. Not the prompt or the answer.
How to check a whole workspace offline
Download an audit export for the workspace or your account-level chain. It includes every receipt, the public keys and the chain head. ClearRun help center.
Other topics
- Get started with ClearRun
- What the ClearRun score means
- ClearRun API, CLI, SDK, and MCP
- ClearRun plans and credits
- ClearRun privacy and data
- ClearRun limits and errors
- ClearRun CLI help
- ClearRun SDK help
- ClearRun MCP help
- ClearRun API help
- ClearRun API key help
- Use ClearRun with other tools
- ClearRun best practices