Deploy the Hive certificate verifier to your own Cloudflare account in 5 minutes. It checks Ed25519 and ML-DSA-65 signatures together, and it never calls receipts.thehiveryiq.com on the fast path.
The verifier runs in your own Cloudflare account, not on receipts.thehiveryiq.com. Each Cloudflare location keeps its own copy of the public keys (JWKS), refreshed every 5 minutes through Workers KV. Once that copy is warm, checking a signature makes zero outbound calls.
When a location needs a fresh copy of the keys (at most once every 5 minutes), it fetches them from hivemorph in the background using ctx.waitUntil. That means your caller never has to wait for it.
The verifier ships as a Cloudflare Worker. You need a Cloudflare account (free tier works) and Node.js 18+.
Request access at security@thehiveryiq.com. You'll get a private GitHub link within 24 hours.
git clone git@github.com:hiveciv/hive-edge-verifier.git cd hive-edge-verifier npm install
The verifier uses Cloudflare KV to cache the JWKS public keys at each edge POP.
npx wrangler kv:namespace create JWKS_CACHE
Copy the output id and paste it into wrangler.toml under [[kv_namespaces]].
npx wrangler login
npx wrangler deploy
Your verifier is live at https://hive-edge-verifier.<account>.workers.dev
# Health check curl https://hive-edge-verifier.<account>.workers.dev/v1/health # Verify a Hive cert curl -X POST https://hive-edge-verifier.<account>.workers.dev/v1/verify \ -H "Content-Type: application/json" \ -d '{ "cert": { "cert_id": "04364b3e08d54264b06443693ddf504b", "agent_did": "did:hive:agent:edge-verifier-001", "controller_did": "did:hive:controller:thehiveryiq", "ed25519_signature": "fJD7UEYzekkAGCXIMFfhu5Umw...", "mldsa65_signature": "RFNBLVNUVUIt...", ... } }'
None of these libraries need Node.js APIs, so they all run fine in the plain Workers runtime. Ed25519 needs no WASM blobs since it uses native WebCrypto. ML-DSA-65 runs as pure JavaScript through the bundled Hive Signer module.
BASE=https://hive-edge-verifier.<account>.workers.dev # Health check, returns { ok, version, edge_pop, ts, runtime } curl "$BASE/v1/health" # JWKS: Ed25519 and ML-DSA-65 public keys, cached for 5 minutes curl "$BASE/v1/verify/jwks" # Verifier metadata curl "$BASE/.well-known/hive-verifier" # Verify a cert (hybrid mode, both sigs checked) curl -X POST "$BASE/v1/verify" \ -H "Content-Type: application/json" \ -d '{"cert": {...}, "mode": "hybrid"}' # Ed25519 only (skip ML-DSA-65) curl -X POST "$BASE/v1/verify" \ -H "Content-Type: application/json" \ -d '{"cert": {...}, "mode": "ed25519_only"}'
The verifier runs on its own, fully separate from receipts.thehiveryiq.com on the fast path. Keys are cached right at the Workers edge.
It checks both Ed25519 (native WebCrypto) and ML-DSA-65 (Hive Signer, pure JavaScript). In hybrid mode, both signatures have to pass.
The cert body is encoded with RFC 8949 deterministic CBOR before the signature gets checked. That matches the did:hive spec signing domain.
Workers KV caches the keys at each location for 5 minutes. If the cache is empty, it refreshes in the background with ctx.waitUntil, so nothing gets blocked.
You can send the cert body as a JSON object or a CBOR base64 string. It figures out which one from the request headers.
It supports full CORS, has a /.well-known/hive-verifier metadata endpoint, and a /v1/verify/jwks endpoint so callers can find the keys.
hivemorph will publish the FIPS 204 ML-DSA-65 public key on its JWKS endpoint. Once that happens, the verifier upgrades itself from stub mode to full lattice verification. You won't need to change any code.
Once /v1/purity/cert/issue ships, the verifier will handle one combined 24-axis bundle that covers Wave-Lattice (6 axes, MAPET) and Loess (18 axes, environmental anchor). You'll be able to send type: "bundle" to POST /v1/verify.
This will check the kem_ct field inside receipt_envelope using FIPS 203 key encapsulation.
This will check the did:hive registry in real time during verification, to see if a key has been revoked, with a cache time you can configure.
Rate limiting for bulk verification jobs, spread across Cloudflare Durable Objects, with separate quotas per DID and per IP.
The repo is available to security partners and enterprises on request. Contact security@thehiveryiq.com with the subject line Edge Verifier Access, and we'll send you the private GitHub link within 24 hours.