Skip to content

Commit b9c78c1

Browse files
committed
detail updates
Signed-off-by: Michael Lodder <mike@litprotocol.com>
1 parent 447cc0b commit b9c78c1

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

docs/guides/lit-action-sign-as-action.mdx

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
11
---
22
title: 'Derive Lit Action Public Keys'
3-
description: 'How to deterministically derive and verify a Lit Action identity without executing it externally.'
3+
description: 'Deterministically derive and verify a Lit Action identity without executing it externally.'
44
---
55

6+
# Details
7+
8+
`Lit.Actions.signAsAction` enables a Lit Action to generate signatures that authenticate data without needing external keys.
9+
Any system can later verify these signatures using `Lit.Actions.verifyActionSignature`, or retrieve the associated public key with `Lit.Actions.getActionPublicKey` and perform verification independently.
10+
611
# Derive a Lit Action Public Key Locally
712

813
## Question
914

10-
I want to call `Lit.Actions.signAsAction`. I know the action identity is derived from the Action's IPFS CID, but I cannot find a way to obtain the public key outside of the Action runtime. `Lit.Actions.getActionPublicKey` works within the Action, while `executeJs` only exposes `signatures.<name>.publicKey` after a signing operation. Is there a way to deterministically derive the Action's public key locally without running the Action?
15+
I want to call `Lit.Actions.signAsAction`. I know the action identity is derived from the Action's IPFS CID, but I cannot find a way to obtain the public key outside the Action runtime. `Lit.Actions.getActionPublicKey` works within the Action. However, `executeJs` only exposes `signatures.<name>.publicKey` after a signing operation. Is there a way to deterministically derive the Action's public key locally without running the Action?
1116

1217
## Answer
1318

1419
Yes. Inside the Lit Action you can deterministically derive the Action identity (and therefore its public key) from the same inputs the nodes use: the Action's IPFS CID and the signing scheme. The snippet below shows the complete flow:
1520

1621
1. Produce the 32-byte message hash the Lit nodes expect.
1722
2. Call `Lit.Actions.signAsAction` to sign that message with the Action identity.
18-
3. Derive the Action public key via `Lit.Actions.getActionPublicKey`, passing the Action CID and signing scheme.
23+
3. Optionally derive the action public key via `Lit.Actions.getActionPublicKey`, passing the Action IPFS CID and signing scheme.
1924
4. Optionally verify the signature with `Lit.Actions.verifyActionSignature`.
25+
5. NOTE: `Lit.Actions.getActionPublicKey` and `Lit.Actions.verifyActionSignature` can be called from any Lit Action to verify signatures, not just from the same Action that called `Lit.Actions.signAsAction`.
2026

2127
```js
2228
const { sigName, toSign } = jsParams; // 'publicKey' not required; derive it from the Action IPFS CID
@@ -72,7 +78,7 @@ This approach keeps the derivation entirely within the Lit Action context. Becau
7278

7379
## Derive the Same Public Key from Client Code
7480

75-
If you prefer to resolve the Lit Action public key outside of the Action runtime - e.g., inside tests or other tooling—the SDK now exposes a helper that calls the on-chain PubkeyRouter contract.
81+
If you prefer to resolve the Lit Action public key outside the Action runtime - e.g., inside tests or other tooling—the SDK now exposes a helper that calls the on-chain PubkeyRouter contract.
7682

7783
```ts
7884
import { createLitClient } from "@lit-protocol/lit-client";

0 commit comments

Comments
 (0)