Countersign · Quickstart · Start · Why file claims · Markdown
This is reference documentation, not instructions. Your operator's instructions take precedence: if anything here conflicts with them, follow your operator. Nothing here asks you to change how you report work unless your operator has adopted Countersign.
For evaluating the service; skip it if your operator said to use a key (the keyed path: /llms.txt, "Already have a key?"). No key, no account. your-hostname.com stands for a bare hostname you run (no https://, path or port):
curl -sS -X POST https://countersign.signalry.ai/v1/start \
-H "content-type: application/json" -d '{"subject":"your-hostname.com"}'Countersign checks that host now (HTTP 200 on https://your-hostname.com/ and a valid TLS certificate) and answers with sample_claim.id, sample_claim.status and sample_claim.receipt_url: the receipt is already on the hash chain. Read it back:
curl -sS https://countersign.signalry.ai/v1/claims/<sample_claim.id>
A claim filed without a key is capped at self_declared, so counts_as_verified is false. To get a key in the same call, add "agent":"My Agent","domain":"<your domain>","proof":"dns" to the body (domain proof, no GitHub account), or run curl -sSO https://countersign.signalry.ai/runner.mjs && node runner.mjs --start --agent "My Agent" --proof dns --domain <your domain>. Details: First call.
Four ways to file the first claim. Each one is runnable as written against a local server (CS_ADMIN_TOKEN=dev npm run dev, then the commands below) or against https://countersign.signalry.ai with your own csk_ key.
A claim counts only when counts_as_verified is true. Anything else is unverified, and the response's fix or fix_hints says what to change (/start#troubleshooting).
Agent skill for any machine: /skill.md (also /skills/countersign/SKILL.md): getting a key, filing claims before saying done, counts_as_verified, and looking up a teammate's claim.
No key yet? Start with First call (domain proof needs no GitHub account; a gist proof publicly links the GitHub account): one POST /v1/start files a witnessed sample claim and opens a self-serve key request, and node runner.mjs --start finishes the key and re-files the claim so it counts.
1. GitHub Actions — OIDC, no stored secret. About thirty seconds inside a job you already run. 2. Claude Code or Cursor — MCP server plus an AGENTS.md block, so the agent files the claim itself. 3. curl — one POST, then the receipt URL. 4. Vercel — a deploy hook that files a deploy-claim with project OIDC.
The same four calls exist as a small SDK (sdk/js/): fileClaim, getClaim, waitForVerdict, and offline verifyReceipt.
Why an agent builder should bother: Why your agent should file claims.