Vouchsafe

Your backend signs JWTs with a private key. Every other service that needs to verify them has to get the public key somehow — config files, environment variables, a JWKS endpoint. When keys rotate, everything has to update in sync or verification starts failing.

Vouchsafe tokens carry the public key inside the token itself, cryptographically bound to the issuer identity. Any receiver can verify locally with nothing but the token. No key distribution step. No rotation headache. No JWKS endpoint to maintain. Drop it in wherever you already use JWTs.

HMAC webhook secrets have to be distributed to every receiver, stored securely, and rotated periodically. If one receiver is compromised, anyone can forge requests. And a valid HMAC only proves someone knew the secret — not which system sent the request.

Vouchsafe webhooks are signed by the sender’s cryptographic identity. The receiver trusts a URN and verifies locally. The signature proves origin, not just knowledge of a shared secret. Nothing to distribute. Nothing to rotate. Nothing to leak.

Most “offline” identity systems mean cached credentials that still required a network at setup time and still call home for revocation checks. When the network is gone, the system either fails or operates on stale, unverifiable state.

Vouchsafe verification is structurally offline. Every token carries everything needed to verify it: identity, public key, signature. Once a token has been issued and delivered, it can be verified by any recipient with no network access, no prior setup, and no revocation endpoint to call. All verification is local math.

Traditional identity requires pre-coordination: shared configs, common authorities, synced registries. Two systems that have never interacted before — distributed nodes, peer-to-peer apps, cross-organizational integrations — have no way to verify each other without first establishing a common reference point.

Vouchsafe tokens are self-describing. The identity name is derived from the key, and the key is in the token. Any recipient can verify that a token genuinely came from the identity it claims, and evaluate the vouch chain, using only the presented token bundle. No directory lookup. No shared registration. No prior arrangement needed on either side.

In traditional systems, identity is granted to you. Someone has to create an account for you before you can participate — your identity is a row in their database, subject to their availability, their policies, and their security practices. If they get breached, someone else can become you. If they shut down, you lose your identity.

Vouchsafe inverts the transaction. You generate a keypair, and that keypair is your identity. You submit proof — a signature — to systems that need to verify you. They check the math; they never hold your secret. There’s nothing on their side to breach. And because the identity lives with you rather than in a database somewhere, there’s no account to request, no approval to wait for, and no service to depend on.

Most delegation is binary and server-enforced. Fine-grained control means custom database logic, additional API calls at every verification point, and a system that stops working the moment the server is unavailable.

Vouchsafe delegation is encoded in the token itself. “This agent may write files to this path, up to 5MB, for the next hour” is a vouch token — signed, scoped to a specific purpose and duration, verifiable offline by anyone with the chain. Purpose constraints can only be narrowed as they propagate, never widened. The delegation is the token, not a row in a database somewhere.