Sign In Register

Support

We're here to help you get the most out of Truestamp. Find answers to common questions or get in touch with our support team.

Community & Updates

Share feedback, follow what we're building next, and see what just shipped. Each opens right here in a popup, so no separate account is needed.

Knowledge Base

Browse the concepts behind Truestamp. Pick a domain to explore, follow the links between concepts, or search across everything.

Knowledge Base
Tag: security

Tagged: security

19

Accounts

API Keys for Programmatic Access Long-lived Truestamp API keys presented as Authorization Bearer credentials to authenticate the JSON:API, GraphQL, and console surfaces, how a key is created, revoked, and audited, and how they differ from OAuth 2.1 used by the MCP surface. Passkeys How Truestamp passkeys work - phishing-resistant WebAuthn sign-in with Touch ID, Face ID, Windows Hello, or a security key that replaces your password, added and managed from your profile, and completing sign-in in one step with no two-factor TOTP code. Signing In to Truestamp How you authenticate to Truestamp - email and password sign-in throttled against brute force, passwordless magic-link sign-in, one-step passkey sign-in, an optional TOTP second factor with single-use recovery codes, and how a signed-in session is established. The Life of a Truestamp Account What happens to an account from sign-up through email confirmation, the one-time immutable username claim, the personal team every user gets, the two system roles, and cascading account deletion. Two-Factor Authentication and Recovery Codes How Truestamp two-factor authentication works - authenticator-app (TOTP) enrollment and verification, single-use recovery codes, and the brute-force rate limit on code entry.

API

Outgoing Webhooks Register and manage HTTPS webhook endpoints over the authenticated JSON:API, GraphQL, and MCP surfaces to receive item event callbacks, with optional bearer-token auth, delivery tracking, and private-IP SSRF safeguards.

Cryptography

Domain-Separated Hashing (SHA-256 Byte Prefixes) How Truestamp separates SHA-256 hash contexts with single-byte domain prefixes (RFC 6962 style), keeping leaf hashes, node hashes, and each kind of hashed object in distinct hash spaces to prevent ambiguity and second-preimage confusion. Ed25519 Signatures How Truestamp uses Ed25519 to sign the 32-byte domain-separated hashes of items, blocks, entropy observations, and proof bundles, what a signature proves to a verifier, and how to fetch and pin the public signing keyring (key ids, rotation lineage) from /.well-known/keyring.json.

Entropy

Public Randomness Beacons What a public randomness beacon is, the security properties that make it trustworthy (unpredictability, bias-resistance, public verifiability, availability), and how Truestamp folds public entropy into publicly verifiable blockchain evidence.

Glossary

API key A long-lived opaque credential (prefix truestamp_) that authenticates programmatic requests as your whole account, sent as an Authorization Bearer header on JSON:API and GraphQL or as a connection parameter on the console WebSocket; the MCP surface never accepts one and requires OAuth 2.1. OAuth 2.1 Truestamp's built-in authorization server (authorize, token, register, revoke endpoints with RFC 8414/9728 discovery) issuing audience-bound access tokens and rotating refresh tokens via PKCE S256 consent, with per-surface mcp/api/console read and write scopes; the only credential MCP accepts. Passkey A phishing-resistant WebAuthn sign-in credential on a Truestamp account, approved with Touch ID, Face ID, Windows Hello, or a security key, completing sign-in in one usernameless step that skips the TOTP prompt; added, renamed, and removed from the profile page. Public randomness beacon A service that periodically publishes unpredictable, bias-resistant, publicly verifiable random values everyone can observe; Truestamp both consumes external beacons such as the NIST Randomness Beacon as entropy and acts as one itself through the public /beacons page. Recovery code A single-use backup code issued in a batch when Truestamp two-factor authentication is enrolled, entered in place of a TOTP code at the second-factor step; each code works exactly once, only a hashed form is stored, and regenerating a batch invalidates the previous one. TOTP Time-based One-Time Password, the optional authenticator-app second factor on a Truestamp account; after a password or magic-link sign-in you enter the app's rotating six-digit code, with code entry rate-limited to 3 attempts per 5-minute window against brute-force guessing. Webhook (outgoing) An HTTPS endpoint registered with Truestamp to receive outgoing item event callbacks, managed over the JSON:API and GraphQL surfaces, with optional bearer-token authentication, delivery tracking, private-IP SSRF safeguards, no HMAC payload signing, and a per-plan endpoint limit.

Integrations

OAuth 2.1 Authorization Server Truestamp's OAuth 2.1 authorization server with authorize, token, register, and revoke endpoints, RFC 8414/9728 discovery documents, PKCE S256, audience-bound tokens, rotating refresh tokens, and per-surface mcp/api/console scopes for authenticating a CLI or MCP agent.

Items

Item Visibility The three item visibility levels (private, team, public), who can read an item at each level, how public items are discovered through anonymous search and the public verification page, who can set and change visibility, and why visibility changes never affect an item's hashes or proof.

Product

Support and Contact Channels How to get help from Truestamp - email [email protected] for general help and [email protected] for responsible vulnerability disclosure, the public /support page (feedback, roadmap, changelog, and a searchable knowledge base browser), the /security page, and /.well-known/security.txt.

Get Help

API Documentation

Comprehensive guides for the REST and GraphQL APIs, including interactive documentation and code examples.

FAQ

Quick answers to the most commonly asked questions about timestamping and verification.

Email Support

Send us a message and our team will respond within 24 hours.

[email protected]

Security Issues

Report security vulnerabilities through our responsible disclosure program.

[email protected]