Quickstart

This walkthrough takes you from zero to a verified proof bundle in about a minute.

1. Sign up and get an API key

Create an account at vitrified.glass/signup. The dashboard's API keys page generates keys scoped to a single project. Keep your secret key in your environment, never in source.

export VITRIFIED_API_KEY="vit_live_..."  <!-- pragma: allowlist secret -->

2. Install the SDK

The JavaScript SDK targets Node 24 and modern browsers.

npm install @vitrified/sdk

Python and a Verifier CLI are available too — see SDKs and Verifier CLI.

3. Submit an attestation

The bytes of your artifact never leave your environment. The SDK hashes locally and submits the digest plus structured metadata.

import { Vitrified } from "@vitrified/sdk";

const vitrified = new Vitrified({ apiKey: process.env.VITRIFIED_API_KEY });

const digest = await vitrified.hashFile("./build/release.tar.gz");

const submission = await vitrified.attestations.create({
  artifact: { sha256: digest },
  metadata: {
    schema: "purl",
    purl: "pkg:npm/[email protected]",
  },
});

console.log(submission.id); // sub_01J...

4. Wait for the bundle

Submissions are aggregated into Merkle batches; each batch root is witnessed in parallel through six independent trust mechanisms. The default cadence is one batch per minute, so most bundles are ready within ~60 seconds of submission.

const bundle = await vitrified.attestations.waitForBundle(submission.id);
console.log(bundle.witnesses);
// → { eidas, rfc3161, rekor, ots, evm, dsse }

5. Verify the bundle

Verification is fully offline and needs nothing from Vitrified.

import { verifyBundle } from "@vitrified/sdk";

const verdict = verifyBundle(bundle);
if (verdict.isVerified) {
  console.log("Bundle verified end-to-end.");
} else {
  console.error(verdict.message, verdict.mechanisms);
}

You can also drop the bundle JSON at verify.vitrified.glass to verify it interactively in the browser.

Next steps

• Concepts: witnessing — what each of the six mechanisms guarantees and how they verify.
• Concepts: proof bundle — the bundle shape, schemas, and long-term verification semantics.
• GitHub Action — drop-in CI attestation for releases.
• MCP server — expose Vitrified as tools any MCP-capable agent can call.