---
title: Verify overview
description: Validate signed payloads with @orbitrail/verify before your application processes them.
url: https://pr-1-3b5c652a9824.thally.app/verify-overview
---

# Verify overview

Validate signed payloads with @orbitrail/verify before your application processes them.

The `@orbitrail/verify` package (v2.5.0) provides a TypeScript SDK for validating signed payloads. It supports multiple signature algorithms, configurable clock tolerance, signature age limits, replay-cache protection, and batched verification through a flush limit.

## Requirements

- **Node.js 20 or later**
- An **OrbitRail API key**
- Zero runtime dependencies

## Installation

#### npm

    ```bash
    npm install @orbitrail/verify
    ```

#### pnpm

    ```bash
    pnpm add @orbitrail/verify
    ```

#### yarn

    ```bash
    yarn add @orbitrail/verify
    ```

## Create a verification client

Use the `createVerifyClient` factory function to create a client with your API key:

```typescript
import { createVerifyClient } from "@orbitrail/verify";

const client = createVerifyClient({
  apiKey: process.env.ORBITRAIL_API_KEY!,
});
```

With the defaults above, the client uses HMAC-SHA256 signatures, a flush limit of 100, 60 seconds of clock tolerance, a maximum signature age of 300 seconds, and a replay cache window of 600 seconds.

## Verify a payload

Call `verify()` with the raw payload string. It returns a `Promise<boolean>`:

```typescript
const isValid = await client.verify(rawPayload);

if (!isValid) {
  return new Response("Signature verification failed", { status: 401 });
}

// Process the verified payload
const data = JSON.parse(rawPayload);
```

## Inspect client settings

Every configuration value is available as a read-only property on the client:

```typescript
const client = createVerifyClient({
  apiKey: "my-key",
  algorithm: "ed25519",
  flushLimit: 250,
});

console.log(client.algorithm);            // "ed25519"
console.log(client.flushLimit);            // 250
console.log(client.clockToleranceSeconds); // 60  (default)
console.log(client.maxSignatureAgeSeconds); // 300 (default)
console.log(client.replayCacheSeconds);    // 600 (default)
```

## TypeScript interfaces

```typescript
export interface VerifyClientOptions {
  apiKey: string;
  flushLimit?: number;
  algorithm?: "hmac-sha256" | "ed25519";
  clockToleranceSeconds?: number;
  maxSignatureAgeSeconds?: number;
  replayCacheSeconds?: number;
}

export interface VerifyClient {
  flushLimit: number;
  algorithm: "hmac-sha256" | "ed25519";
  clockToleranceSeconds: number;
  maxSignatureAgeSeconds: number;
  replayCacheSeconds: number;
  verify(payload: string): Promise<boolean>;
}
```