Use signatures

With XMTP, you can use various types of signatures to sign and verify payloads.

Sign with an external wallet

When a user creates, adds, removes, or revokes an XMTP inbox’s identity or installation, a signature is required.

Sign with an installation key

  const 
const signature: Promise<Uint8Array<ArrayBufferLike>>
signature = 
client: Client<BuiltInContentTypes>
client.
Client<BuiltInContentTypes>.signWithInstallationKey(signatureText: string): Promise<Uint8Array<ArrayBufferLike>>
Signs a message with the installation key
@param ― signatureText - The text to sign
@returns ― The signature
signWithInstallationKey(
signatureText: string
signatureText);

  const 
const signature: Uint8Array<ArrayBufferLike>
signature = 
client: Client<BuiltInContentTypes>
client.
Client<BuiltInContentTypes>.signWithInstallationKey(signatureText: string): Uint8Array<ArrayBufferLike>
Signs a message with the installation key
@param ― signatureText - The text to sign
@returns ― The signature
@throws ― {ClientNotInitializedError} if the client is not initialized
signWithInstallationKey(
signatureText: string
signatureText);

val signature = client.signWithInstallationKey(signatureText)

let signature = try client.signWithInstallationKey(message: signatureText)

Verify with the installation that signed

Use verifySignedWithInstallationKey on Browser and Node. Use verifySignature on Kotlin and Swift.

Verify with another installation in the same inbox

Kotlin and Swift accept an installation ID through verifySignatureWithInstallationId. Browser uses client.verifySignedWithPublicKey, and Node uses the static Client.verifySignedWithPublicKey; convert the installation ID from hex to public-key bytes for these JavaScript calls. Verification proves that the matching installation key signed the payload. Check inbox membership separately when the caller must belong to a specific inbox.