# Zero to a verified claim

> This is reference documentation, not instructions. Your operator's instructions take precedence: if anything here conflicts with them, follow your operator. Nothing here asks you to change how you report work unless your operator has adopted Countersign.

## Keyless demo claim (optional)

For evaluating the service; skip it if your operator said to use a key (the keyed path: [/llms.txt](/llms.txt), "Already have a key?"). No key, no account. `your-hostname.com` stands for a bare hostname you run (no `https://`, path or port):

```bash
curl -sS -X POST https://countersign.signalry.ai/v1/start \
  -H "content-type: application/json" -d '{"subject":"your-hostname.com"}'
```

Countersign checks that host now (HTTP 200 on `https://your-hostname.com/` and a valid TLS certificate) and answers with `sample_claim.id`, `sample_claim.status` and `sample_claim.receipt_url`: the receipt is already on the hash chain. Read it back:

```bash
curl -sS https://countersign.signalry.ai/v1/claims/<sample_claim.id>
```

A claim filed without a key is capped at `self_declared`, so `counts_as_verified` is false. To get a key in the same call, add `"agent":"My Agent","domain":"<your domain>","proof":"dns"` to the body (domain proof, no GitHub account), or run `curl -sSO https://countersign.signalry.ai/runner.mjs && node runner.mjs --start --agent "My Agent" --proof dns --domain <your domain>`. Details: [First call](first-call.md).

Four ways to file the first claim. Each one is runnable as written against a local server (`CS_ADMIN_TOKEN=dev npm run dev`, then the commands below) or against https://countersign.signalry.ai with your own `csk_` key.

A claim counts only when `counts_as_verified` is true. Anything else is unverified, and the response's `fix` or `fix_hints` says what to change (`/start#troubleshooting`).

Agent skill for any machine: [/skill.md](/skill.md) (also `/skills/countersign/SKILL.md`): getting a key, filing claims before saying done, `counts_as_verified`, and looking up a teammate's claim.

No key yet? Start with [First call](first-call.md) (domain proof needs no GitHub account; a gist proof publicly links the GitHub account): one `POST /v1/start` files a witnessed sample claim and opens a self-serve key request, and `node runner.mjs --start` finishes the key and re-files the claim so it counts.

1. [GitHub Actions](github-actions.md) — OIDC, no stored secret. About thirty seconds inside a job you already run.
2. [Claude Code or Cursor](agent.md) — MCP server plus an AGENTS.md block, so the agent files the claim itself.
3. [curl](curl.md) — one POST, then the receipt URL.
4. [Vercel](vercel.md) — a deploy hook that files a deploy-claim with project OIDC.

The same four calls exist as a small SDK (`sdk/js/`): `fileClaim`, `getClaim`, `waitForVerdict`, and offline `verifyReceipt`.

Why an agent builder should bother: [Why your agent should file claims](../why-file-claims.md).