Quickstart

Sign a file and verify it in under a minute. Signing happens in your Flowsta Vault - your keys never leave your device.

Sign a File

Prerequisites

• Flowsta Vault installed and set up with a recovery phrase

Sign

1. Open Flowsta Vault and unlock it
2. Click Sign It in the sidebar
3. Drag files onto the drop zone (or click Choose Files to select one or more)
4. Vault hashes each file and runs integrity checks automatically (integrity checks and perceptual hashing are skipped for files over 500 MB)
5. Choose your metadata:
   • AI Generation - No AI, Part AI Generated, or AI Generated (or leave it undeclared)
   • Content Rights - License, commercial availability, AI training policy, contact preference
   • Public Note - Optional signer comment (up to 280 characters) shown to verifiers
6. Click Sign File (or Sign N Files for a batch)
7. Vault signs each hash with your key and commits it to your local conductor

Your signatures publish to Flowsta's tamper-proof network, built on Holochain, via peer-to-peer gossip - typically verifiable by anyone within minutes. Works offline too: signatures made offline publish when you reconnect.

View Your Signatures

• Recent Signatures shows your latest 5 on the Sign It page
• Click View all to see everything; revoked signatures sit behind a Show revoked toggle

Verify a File

1. Go to flowsta.com/sign-it/verify
2. Drop the file onto the page (or click Choose File)
3. Exact match: the file is hashed in your browser and the hash is looked up - for this step the file never leaves your device
4. Fuzzy match: when nothing matches exactly, images, audio and video are sent to the server for perceptual fingerprinting and discarded - this finds similar versions (resized, re-encoded, trimmed)
5. See all signatures: who signed, when, their declared rights, AI disclosure, Public Notes, and revocation status

Verification is free on every plan - no sign-in needed. The public API is rate-limited per IP address.

Verify via API

curl "https://auth-api.flowsta.com/api/v1/sign-it/verify?hash=a7f3b9c1e2d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0"

Returns all signatures for that SHA-256 hash, including metadata and revocation status. See the Verification API.

Request Signatures from Your App (for developers)

Your app never signs anything itself - it asks the user's Vault, and the user approves each signature in a Vault dialog. Two paths:

• Linked Holochain apps (@flowsta/holochain 3.6.0+) can ask the Vault to publish the signature to the Sign It network from the person's own device. Published signatures your app initiates draw from your organization's sponsored signing pool when you have one, not the user's personal quota.
• Web apps (@flowsta/auth) get a signature the Vault made for the app. It is returned to your app and is not published, so nobody else can verify the file by it. People publish from their own Vault.

Web Apps (OAuth + Vault)

import { FlowstaAuth, hashFile } from '@flowsta/auth';

const flowsta = new FlowstaAuth({
  clientId: 'your_client_id',
  redirectUri: 'https://your-app.com/callback',
  scopes: ['openid', 'display_name', 'sign'],
});

// After user logs in...
const hash = await hashFile(file);
const result = await flowsta.signFile({
  fileHash: hash,
  intent: 'Authorship',
  contentRights: { license: 'cc-by', aiTraining: 'not_allowed' },
});
// result.agent_pub_key - who approved; result.action_hash is null (not published)

signFile() detects the user's running Vault and signs through it - the user approves in the Vault dialog and the key stays on their device. The result confirms the approval and carries the signer's agent key and the time; the signature stays with your app and is not on the network. If no Vault can sign, it throws VaultRequiredError so you can prompt the user to open or install Vault; if the browser blocked the page from reaching the Vault, it throws VaultBlockedError instead (2.5.0).

Desktop Holochain Apps (Vault IPC)

import { signDocument } from '@flowsta/holochain';

const result = await signDocument({
  clientId: 'flowsta_app_abc123...',
  appName: 'ArtStudio',
  fileHash: 'a7f3b9c1e2d4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0',
  label: 'Illustration.png',
  intent: 'authorship',
  contentRights: { license: 'cc-by', aiTraining: 'not_allowed' },
});

if (result.published) {
  console.log('Published, action hash:', result.actionHash);
}

The user sees an approval dialog in Vault - your app name, the file label, the first characters of the hash, and, for a published signature, whose signing quota pays. If approved, the Vault signs the hash and, when your app is linked to the person's identity (linkFlowstaIdentity), publishes the signature from their device to the Sign It network; it then gossips to the rest of the network, typically verifiable within minutes. An app that is not linked gets the signature back unpublished (published: false, actionHash: null); asking such an app to publish (publish: true) throws PublishForbiddenError.

Next Steps

• Content Rights - Full guide to the rights manifest
• Developer Guide - Vault signing integration, quotas, sponsored signing
• Verification API - Programmatic file verification
• SDK Reference - Complete SDK reference