Programmatic payout signing (machine signers)

import crypto from "node:crypto";

export function generateSignerKeypair() {
  const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", {
    namedCurve: "prime256v1",
  });
  const jwk = publicKey.export({ format: "jwk" });
  const x = Buffer.from(jwk.x!, "base64url");
  const y = Buffer.from(jwk.y!, "base64url");
  const prefix = (y[y.length - 1] & 1) === 1 ? 0x03 : 0x02;

  return {
    // Register this with Conduit.
    compressedPublicKeyHex: Buffer.concat([Buffer.from([prefix]), x]).toString(
      "hex",
    ),
    // Store this in your secret manager. Never log it, never send it.
    privateKeyPem: privateKey.export({
      format: "pem",
      type: "pkcs8",
    }) as string,
  };
}

POST /v2/customers/:id/wallets/claim-non-custodial
{
  "roster": [
    { "email": "alice@yourcompany.com", "role": "admin", "credentialType": "passkey" },
    { "email": "bob@yourcompany.com",   "role": "admin", "credentialType": "passkey" },
    { "email": "signer-1@yourcompany.com", "role": "signer", "credentialType": "api_key", "publicKey": "02a1b2c3..." },
    { "email": "signer-2@yourcompany.com", "role": "signer", "credentialType": "api_key", "publicKey": "03d4e5f6..." }
  ],
  "signingThreshold": 2,
  "chains": ["ethereum"]
}

GET /v2/signing-requests
x-api-key: {{apiKey}}

{
  "data": [
    {
      "id": "vrf_9c8b...",
      "transactionId": "txn_5f2a...",
      "customerId": "cus_1a2b...",
      "status": "awaiting_signature",
      "requiredApprovals": 2,
      "approvedCount": 1,
      "expiresAt": "2026-07-01T12:00:00.000Z",
      "createdAt": "2026-07-01T11:30:00.000Z",
      "approvalMaterial": {
        "version": "1",
        "activityId": "act_...",
        "fingerprint": "fp_...",
        "subOrganizationId": "sub-org-...",
        "outbound": {
          "toAddress": "0xrecipient...",
          "assetAmount": {
            "code": "USDC",
            "chain": "ethereum",
            "amount": "100.000000"
          }
        }
      }
    }
  ],
  "meta": {
    "mode": "cursor",
    "nextCursor": null,
    "previousCursor": null,
    "total": 1
  }
}

{
  "type": "ACTIVITY_TYPE_APPROVE_ACTIVITY",
  "timestampMs": "1750000000000",
  "organizationId": "<approvalMaterial.subOrganizationId>",
  "parameters": { "fingerprint": "<approvalMaterial.fingerprint>" }
}

import crypto from "node:crypto";

const CONDUIT_API = "https://api.conduit.financial";
const STAMP_SCHEME = "SIGNATURE_SCHEME_TK_API_P256"; // fixed constant - send verbatim

// Sign `signedBody` with the machine key and return the stamp value Conduit expects.
function buildStamp(
  signedBody: string,
  compressedPublicKeyHex: string,
  privateKeyPem: string,
): string {
  const signature = crypto
    .createSign("SHA256")
    .update(signedBody)
    .sign({ key: privateKeyPem, dsaEncoding: "der" }, "hex");
  const envelope = JSON.stringify({
    publicKey: compressedPublicKeyHex,
    scheme: STAMP_SCHEME,
    signature,
  });
  return Buffer.from(envelope).toString("base64url");
}

// Approve (or reject) one signing request discovered from GET /v2/signing-requests.
export async function submitApproval(
  request: {
    id: string;
    approvalMaterial: { fingerprint: string; subOrganizationId: string };
  },
  keys: {
    apiKey: string;
    compressedPublicKeyHex: string;
    privateKeyPem: string;
  },
  decision: "approve" | "reject" = "approve",
) {
  const activityType =
    decision === "approve"
      ? "ACTIVITY_TYPE_APPROVE_ACTIVITY"
      : "ACTIVITY_TYPE_REJECT_ACTIVITY";
  const signedBody = JSON.stringify({
    type: activityType,
    timestampMs: Date.now().toString(),
    organizationId: request.approvalMaterial.subOrganizationId,
    parameters: { fingerprint: request.approvalMaterial.fingerprint },
  });
  const stamp = buildStamp(
    signedBody,
    keys.compressedPublicKeyHex,
    keys.privateKeyPem,
  );

  const res = await fetch(
    `${CONDUIT_API}/v2/signing-requests/${request.id}/${decision}`,
    {
      method: "POST",
      headers: {
        "content-type": "application/json",
        "x-api-key": keys.apiKey,
        "idempotency-key": crypto.randomUUID(),
      },
      body: JSON.stringify({ signedBody, stamp }),
    },
  );
  if (!res.ok)
    throw new Error(
      `stamp submission failed (${res.status}): ${await res.text()}`,
    );
  return res.json(); // the signing request in its new state
}