Rotate and retire receipt-signing verification keys

What this is

Abraxas signs eligibility receipts with an environment-scoped Ed25519 key. Partners verify the public receipt, including signature_valid and currently_valid. This registry lets operators rotate or revoke verification keys without exposing private signing material and without silently trusting unknown key IDs.

This is not a key-management dashboard, browser key editor, self-service Production issuer, or blockchain key registry.

Architecture

env ABRAXAS_SIGNING_KEY (private, environment-only)
env ABRAXAS_PUBLIC_KEY + ABRAXAS_SIGNING_KEY_ID
optional ABRAXAS_RECEIPT_VERIFICATION_REGISTRY (public lifecycle entries)
  -> issue only with active in-window key for this runtime
  -> verify receipt.signing_key_id through the registry
  -> GET /api/receipts/verification-keys (public-safe document)
partners re-fetch public receipt; signature is not a grant

Operator rotation

1. Add the new key's public JWK and key ID to ABRAXAS_RECEIPT_VERIFICATION_REGISTRY as status active, environment-scoped, with schema 1.0.0.
2. Configure ABRAXAS_SIGNING_KEY and ABRAXAS_SIGNING_KEY_ID in that environment only. Never commit private material.
3. Issue new receipts with the active in-window key. Do not re-sign historical receipts.
4. Mark the previous key retiring with allow_historical_verification true so existing signatures still verify.
5. After the overlap window, mark it retired. Historical verification remains allowed only while lifecycle rules say so.
6. Revoke only for compromise or explicit invalidation. Revoked keys never verify.
7. Never copy DEMO registry entries or private keys into Production, or the reverse.

Partner trust document

// Backend first. Re-fetch the current receipt. Honor currently_valid and revocation.
const keys = await fetch("https://abraxasworld.xyz/api/receipts/verification-keys");
const document = await keys.json();
// document.keys[].public_jwk is Ed25519 OKP { kty, crv, x } only.
// Never send signing_key_id, private keys, or environment overrides to Abraxas.

const receipt = await fetch("https://abraxasworld.xyz/api/receipts/" + receiptId + "/public");
const view = await receipt.json();
if (view.signature_valid !== true || view.currently_valid !== true) {
  return { allowed: false };
}

Public receipt: Partner Flow · Kit: Integration Kit · Actions: Portable action contract · Mainnet: Mainnet readiness