Security guidance
How credentials, keys and pairing work for your integration.
Keys and verification
- Your integration creates and keeps its Ed25519 private key. WAYLOCK never asks for it, and no WAYLOCK page signs anything.
- Verification proves your integration holds the key. A verified external agent still has no financial authority by itself.
- If a key may be compromised, revoke verification. Verify a new key before pairing again.
Pairing
- A pairing code is single-use, expires quickly and is shown once. It only pairs; it is not a credential.
- Your integration redeems it with a signed proof. A code received is not a connection until redemption completes.
Credentials
- The agent credential is returned only to your integration. WAYLOCK pages show its status, never its value.
- Rotation is not available in the browser. It uses the API with a person's server-side session (rotateAgentCredential).
- A person can revoke a credential at any time. Revocation is final.