Signatures

Verify an ECDSA signature

POSThttps://ecdsa.com/api/v1/verify

Verifies a signature over a message (or a precomputed digest) against a public key. Curves: P-256, P-384, P-521, secp256k1. Signature formats auto-detected: ASN.1 DER or raw r‖s, in hex, base64 or base64url. Public key formats: PEM SPKI ("PUBLIC KEY"), EC JWK, or a bare SEC1 point in hex/base64. A signature that simply does not verify returns valid: false with HTTP 200; only unparseable input yields 400.

Clave de API: Opcional; una clave necesita el ámbito api
Consumo de cuota con clave: 1 unidad por llamada
Límite de frecuencia: 60 solicitudes/min por IP

Solicitud

Cuerpo JSON: VerifyRequest

Campo	Tipo	Obligatorio	Descripción
publicKey	string	sí	PEM "PUBLIC KEY" (SPKI), EC JWK JSON, or a bare SEC1 point in hex/base64.
message	string	sí	The signed message (or its digest — see messageIsDigest).
signature	string	sí	DER or raw r‖s signature in hex, base64 or base64url (auto-detected).
hash	string	no	Digest applied to the message (ignored when messageIsDigest is true). predeterminado: "SHA-256" uno de "SHA-256", "SHA-384" o "SHA-512"
curve	string	no	Force a curve, or auto to infer it from the key. predeterminado: "auto" uno de "auto", "P-256", "P-384", "P-521" o "secp256k1"
messageEncoding	string	no	How the message string encodes bytes. predeterminado: "utf8" uno de "utf8", "hex" o "base64"
messageIsDigest	boolean	no	When true, message bytes are used as the digest directly (no hashing). predeterminado: false

Respuestas

200Verification outcome.

Campo	Tipo	Obligatorio	Descripción
valid	boolean	sí
curve	string \| null	sí	Curve the signature verified on (or the single candidate when it did not).
curvesTried	string[]	sí	Every curve tried, in order.
keySource	string	sí	How the public key was encoded. uno de "pem-spki", "jwk" o "raw-point"
signatureFormat	string	sí	uno de "der" o "raw"
details	object	sí
details.r	string	sí	r as hex.
details.s	string	sí	s as hex.
details.highS	boolean	sí	s > n/2 (non-canonical for Bitcoin & co).
notes	string[]	sí	Per-curve diagnostics.

Encabezados: X-Request-Id · X-RateLimit-Limit · X-RateLimit-Remaining · X-RateLimit-Reset · X-Quota-Limit · X-Quota-Remaining · X-Quota-Reset

Estado	Significado	Códigos
400	Bad request. Input limits: a request body of at most 100 KB (a larger one is answered with 413) and arrays and objects nested at most 64 levels deep, JSON documents inside string fields included.	invalid_json missing_field invalid_input private_key_rejected
401	Unauthorized.	unauthorized
403	Forbidden.	forbidden_scope
404	Not found.	not_found
405	Method not allowed.	method_not_allowed
413	Payload too large.	payload_too_large
429	Too many requests.	rate_limited quota_exceeded
500	Internal server error.	internal_error
503	Service unavailable.	service_unavailable
504	Gateway timeout.	timeout

Todas las respuestas de error incluyen el sobre JSON; la tabla de errores explica qué significa cada código y qué hacer.

Ejemplo

P-256 key as PEM, UTF-8 message, DER signature

curl

curl -sS 'https://ecdsa.com/api/v1/verify' \
  -H 'content-type: application/json' \
  -d '{
  "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4+8TCP3Hop/Acb8L7reksO9flyt1\nsUhvEqUs7a45RVDRDtAIZdTnOJcAhTCQvdzUBO4KUyxSRcZm6ro+2RGfSQ==\n-----END PUBLIC KEY-----",
  "message": "The quick brown fox jumps over the lazy dog",
  "signature": "3045022100df542bb71e0e3019086f1b1ba51f1aa0ec5e6afca05c3f5a7f4f02f5b7c39d24022030c59f1ac6d8c6893fb2a5ac8dfd9388d31ebd3382510dcfb7f28f9182eb1131"
}'

JavaScript (fetch)

const response = await fetch("https://ecdsa.com/api/v1/verify", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4+8TCP3Hop/Acb8L7reksO9flyt1\nsUhvEqUs7a45RVDRDtAIZdTnOJcAhTCQvdzUBO4KUyxSRcZm6ro+2RGfSQ==\n-----END PUBLIC KEY-----",
    "message": "The quick brown fox jumps over the lazy dog",
    "signature": "3045022100df542bb71e0e3019086f1b1ba51f1aa0ec5e6afca05c3f5a7f4f02f5b7c39d24022030c59f1ac6d8c6893fb2a5ac8dfd9388d31ebd3382510dcfb7f28f9182eb1131"
  }),
});
console.log(response.status, await response.json());

Python (httpx)

import httpx

response = httpx.post(
    "https://ecdsa.com/api/v1/verify",
    json={
        "publicKey": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4+8TCP3Hop/Acb8L7reksO9flyt1\nsUhvEqUs7a45RVDRDtAIZdTnOJcAhTCQvdzUBO4KUyxSRcZm6ro+2RGfSQ==\n-----END PUBLIC KEY-----",
        "message": "The quick brown fox jumps over the lazy dog",
        "signature": "3045022100df542bb71e0e3019086f1b1ba51f1aa0ec5e6afca05c3f5a7f4f02f5b7c39d24022030c59f1ac6d8c6893fb2a5ac8dfd9388d31ebd3382510dcfb7f28f9182eb1131",
    },
    timeout=30.0,
)
print(response.status_code, response.json())

Respuesta 200

{
  "valid": true,
  "curve": "P-256",
  "curvesTried": [
    "P-256"
  ],
  "keySource": "pem-spki",
  "signatureFormat": "der",
  "details": {
    "r": "df542bb71e0e3019086f1b1ba51f1aa0ec5e6afca05c3f5a7f4f02f5b7c39d24",
    "s": "30c59f1ac6d8c6893fb2a5ac8dfd9388d31ebd3382510dcfb7f28f9182eb1131",
    "highS": false
  },
  "notes": []
}

La respuesta de la API a este ejemplo, generada para esta página el 20 de octubre de 2026; los tiempos relativos y los recuentos de días que contiene se refieren a ese día.

Códigos de error

Código	Estado	Significado
invalid_json	400	The body is not valid JSON or not a JSON object; or the input nests arrays and objects more than 64 levels deep (JSON documents inside string fields count too), or is too complex to inspect for private keys.
missing_field	400	A required field is absent or empty.
invalid_input	400	A field could not be parsed — the message explains exactly why.
private_key_rejected	400	The request contains private-key material (a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY private key, or a JWK with "d"). Never send private keys anywhere.
unauthorized	401	The Authorization or X-API-Key header is malformed, the API key is not valid (wrong checksum, unknown, revoked or expired), or the operation needs a key.
forbidden_scope	403	The API key is valid but lacks a scope this operation requires; the message names it.
not_found	404	No operation exists at this path.
method_not_allowed	405	The path exists but does not accept this HTTP method; see the Allow header.
payload_too_large	413	The body exceeds 100 KB.
rate_limited	429	Too many requests — see Retry-After.
quota_exceeded	429	A daily or monthly quota of the API key's account is used up. X-Quota-Reset (and Retry-After) say when it starts over; retrying earlier cannot succeed.
internal_error	500	Unexpected server error.
service_unavailable	503	API keys cannot be verified right now (the key store is unreachable); retry shortly.
timeout	504	The operation did not finish within its time budget.

Esquemas

Error

The error envelope of every non-2xx response.

Campo	Tipo	Obligatorio	Descripción
error	object	sí
error.code	string	sí	Machine-readable error code. Each response lists the codes it can carry; new codes may be added within v1, so treat an unknown code by its HTTP status.
error.message	string	sí	Human-readable explanation (English).
error.requestId	string	no	The X-Request-Id of this request — quote it when reporting a problem. Sent since v1.1.
error.detail	object	no	Structured context for the error, such as the offending field; omitted when there is none. cualquier nombre de miembro
error.docs	string	no	Where the error codes are explained. Sent since v1.1. formato uri

Todas las operaciones aparecen en la referencia de la API.