Cloudflare Workers · Off-Render

Edge verification.
Off Render. Under 50ms p99.

Deploy the Hive certificate verifier to your own Cloudflare account in 5 minutes. It checks Ed25519 and ML-DSA-65 signatures together, and it never calls receipts.thehiveryiq.com on the fast path.

<50ms p99 warm (JWKS cached)
<500ms cold path (JWKS miss)
5min JWKS cache TTL per POP
2 sig schemes (Ed25519 + ML-DSA-65)

An edge layer that skips the round trip

The verifier runs in your own Cloudflare account, not on receipts.thehiveryiq.com. Each Cloudflare location keeps its own copy of the public keys (JWKS), refreshed every 5 minutes through Workers KV. Once that copy is warm, checking a signature makes zero outbound calls.

When a location needs a fresh copy of the keys (at most once every 5 minutes), it fetches them from hivemorph in the background using ctx.waitUntil. That means your caller never has to wait for it.

Live MIT License Workers KV FIPS 204 RFC 8949 CBOR
CLIENT POST /v1/verify CLOUDFLARE WORKERS EDGE POP index.ts router verify.ts orchestrator ed25519.ts WebCrypto subtle.verify mldsa65.ts Hive Signer post-quantum cbor.ts RFC 8949 deterministic Workers KV JWKS cache · 5 min TTL receipts.thehiveryiq.com /v1/prov/pubkey (JWKS) miss { valid, signers, age_ms, posture, errors } back to client HOT PATH: 0 outbound requests

Deploy in 5 minutes

The verifier ships as a Cloudflare Worker. You need a Cloudflare account (free tier works) and Node.js 18+.

1

Clone the repo

Request access at security@thehiveryiq.com. You'll get a private GitHub link within 24 hours.

bash
git clone git@github.com:hiveciv/hive-edge-verifier.git
cd hive-edge-verifier
npm install
2

Create KV namespace

The verifier uses Cloudflare KV to cache the JWKS public keys at each edge POP.

bash
npx wrangler kv:namespace create JWKS_CACHE

Copy the output id and paste it into wrangler.toml under [[kv_namespaces]].

3

Authenticate with Cloudflare

bash
npx wrangler login
4

Deploy to Workers

bash
npx wrangler deploy

Your verifier is live at https://hive-edge-verifier.<account>.workers.dev

5

Verify your first cert

bash
# Health check
curl https://hive-edge-verifier.<account>.workers.dev/v1/health

# Verify a Hive cert
curl -X POST https://hive-edge-verifier.<account>.workers.dev/v1/verify \
  -H "Content-Type: application/json" \
  -d '{
    "cert": {
      "cert_id": "04364b3e08d54264b06443693ddf504b",
      "agent_did": "did:hive:agent:edge-verifier-001",
      "controller_did": "did:hive:controller:thehiveryiq",
      "ed25519_signature": "fJD7UEYzekkAGCXIMFfhu5Umw...",
      "mldsa65_signature": "RFNBLVNUVUIt...",
      ...
    }
  }'

Hybrid post-quantum verification

Layer Library / API Standard Status
Ed25519 verification crypto.subtle.verify RFC 8032 · WebCrypto Level 2 Native
ML-DSA-65 verification hive-signer/ml-dsa NIST FIPS 204 Pure JS
Canonical CBOR encoding cbor-x + RFC 8949 RFC 8949 §4.2.1 deterministic Workers-safe
Hash (SHAKE-256) hive-signer/hashes NIST FIPS 202 XOF Pure JS
JWKS edge cache Cloudflare Workers KV 5-min TTL per POP KV binding required

None of these libraries need Node.js APIs, so they all run fine in the plain Workers runtime. Ed25519 needs no WASM blobs since it uses native WebCrypto. ML-DSA-65 runs as pure JavaScript through the bundled Hive Signer module.

Target benchmarks

<50ms
p99, warm cache
Keys are served straight from Workers KV at the same location. Ed25519 runs on native WebCrypto. No outbound HTTP at all.
<500ms
p99, cold (key refresh)
Happens at most once every 5 minutes per location. It refreshes in the background, so it never blocks the response to your caller.
300+
edge locations served
Runs on Cloudflare's global network. Every location keeps its own copy of the keys, so there's no single choke point.

API reference: curl examples

bash
BASE=https://hive-edge-verifier.<account>.workers.dev

# Health check, returns { ok, version, edge_pop, ts, runtime }
curl "$BASE/v1/health"

# JWKS: Ed25519 and ML-DSA-65 public keys, cached for 5 minutes
curl "$BASE/v1/verify/jwks"

# Verifier metadata
curl "$BASE/.well-known/hive-verifier"

# Verify a cert (hybrid mode, both sigs checked)
curl -X POST "$BASE/v1/verify" \
  -H "Content-Type: application/json" \
  -d '{"cert": {...}, "mode": "hybrid"}'

# Ed25519 only (skip ML-DSA-65)
curl -X POST "$BASE/v1/verify" \
  -H "Content-Type: application/json" \
  -d '{"cert": {...}, "mode": "ed25519_only"}'

What ships in v1.0

Off-Render architecture

The verifier runs on its own, fully separate from receipts.thehiveryiq.com on the fast path. Keys are cached right at the Workers edge.

Hybrid sig verification

It checks both Ed25519 (native WebCrypto) and ML-DSA-65 (Hive Signer, pure JavaScript). In hybrid mode, both signatures have to pass.

Canonical CBOR domain

The cert body is encoded with RFC 8949 deterministic CBOR before the signature gets checked. That matches the did:hive spec signing domain.

KV edge cache

Workers KV caches the keys at each location for 5 minutes. If the cache is empty, it refreshes in the background with ctx.waitUntil, so nothing gets blocked.

JSON + CBOR input

You can send the cert body as a JSON object or a CBOR base64 string. It figures out which one from the request headers.

CORS + JWKS metadata

It supports full CORS, has a /.well-known/hive-verifier metadata endpoint, and a /v1/verify/jwks endpoint so callers can find the keys.

What's coming

Soon

Full ML-DSA-65 key publication

hivemorph will publish the FIPS 204 ML-DSA-65 public key on its JWKS endpoint. Once that happens, the verifier upgrades itself from stub mode to full lattice verification. You won't need to change any code.

Soon

Combined 24-axis bundle verification (Wave + Loess)

Once /v1/purity/cert/issue ships, the verifier will handle one combined 24-axis bundle that covers Wave-Lattice (6 axes, MAPET) and Loess (18 axes, environmental anchor). You'll be able to send type: "bundle" to POST /v1/verify.

Future

ML-KEM-768 KEM receipt unwrapping

This will check the kem_ct field inside receipt_envelope using FIPS 203 key encapsulation.

Future

did:hive revocation registry check

This will check the did:hive registry in real time during verification, to see if a key has been revoked, with a cache time you can configure.

Future

Durable Objects rate limiting

Rate limiting for bulk verification jobs, spread across Cloudflare Durable Objects, with separate quotas per DID and per IP.

Deploy the verifier to your Cloudflare account

The repo is available to security partners and enterprises on request. Contact security@thehiveryiq.com with the subject line Edge Verifier Access, and we'll send you the private GitHub link within 24 hours.