How it works
From event to certificate
in under 200ms
SHA-256 hash · RFC 3161 timestamp · RSA-PSS signature. No infrastructure to manage. Just an API key.
What this means for your business
If a client disputes that a step happened, you have independent proof — not just your word.
Enterprise buyers increasingly require third-party proof before they'll sign. TaaS gives you that without enterprise pricing.
Anyone can claim they run a tight process. Few can get it certified by an independent third party.
A certificate answers "how do we know this actually happened?" before it becomes a stalled deal.
Authenticate with your API key
Every TaaS request is authenticated with an API key tied to your account. Keys are hashed — never stored in plaintext. Rotate them anytime from your dashboard.
curl -X POST https://api.trytaas.com/v1/certify \
-H "X-API-Key: taas_live_xxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{ ... }'Send your event payload
POST any JSON payload to /v1/certify. You define the structure — TaaS certifies it. Include a "type" field to categorize the event (payment_confirmed, app_install, delivery_complete, etc.).
{
"type": "payment_confirmed",
"payload": {
"amount": 499.00,
"currency": "USD",
"buyer_id": "usr_abc123",
"order_id": "ord_xyz789"
},
"metadata": {
"app_id": "com.acme.marketplace",
"platform": "android",
"client_ip": "203.0.113.1"
}
}TaaS hashes, timestamps, and signs
Internally: the payload is canonicalized, SHA-256 hashed, anchored with an RFC 3161 timestamp from a trusted TSA, and signed with RSA-PSS-SHA256. This happens in <200ms.
# Internal process (transparent to you)
canonical = sort_keys(payload)
hash = SHA256(canonical)
timestamp = RFC3161.tsa.stamp(hash) # RFC 3161 compliant
signature = RSA_PSS.sign(hash + timestamp, private_key)
cert_id = UUID4()Certificate returned
You receive a signed certificate object. Download the PDF for legal records or use the JSON for programmatic verification. Both are self-contained.
{
"cert_id": "cert_5f3a8c2d-e91b-4f7a-a23c-1b2d3e4f5a6b",
"hash": "a3f4b2c1e9d7f8a0b5c6d2e1f4a3b7c8...",
"algorithm": "SHA-256",
"timestamp": "2026-06-01T14:30:01.234567Z",
"tsa": "RFC3161-compliant",
"signature": { "algorithm": "RSA-PSS-SHA256", "key_id": "taas_key_2026" },
"valid": true,
"pdf_url": "https://certs.trytaas.com/cert_5f3a..."
}Verify anytime — no credentials needed
The verification endpoint is public. Judges, auditors, and your users can verify a certificate by its ID — without an API key, without a TaaS account.
GET /v1/verify/cert_5f3a8c2d-e91b-4f7a-a23c-1b2d3e4f5a6b
# Response:
{
"cert_id": "cert_5f3a...",
"valid": true,
"issued_at": "2026-06-01T14:30:01Z",
"hash": "a3f4b2c1...",
"tampered": false
}Cryptographic standards used
SHA-256
Hash algorithm — NIST-approved, collision-resistant
RFC 3161
Trusted timestamp — internationally recognized standard
RSA-PSS
Digital signature — PKCS#1 v2.1 probabilistic signing
X.509
Certificate format — compatible with standard PKI tooling