Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions docs/guides/lit-action-sign-as-action.mdx
Original file line number Diff line number Diff line change
@@ -1,22 +1,28 @@
---
title: 'Derive Lit Action Public Keys'
description: 'How to deterministically derive and verify a Lit Action identity without executing it externally.'
description: 'Deterministically derive and verify a Lit Action identity without executing it externally.'
---

# Details

`Lit.Actions.signAsAction` enables a Lit Action to generate signatures that authenticate data without needing external keys.
Any system can later verify these signatures using `Lit.Actions.verifyActionSignature`, or retrieve the associated public key with `Lit.Actions.getActionPublicKey` and perform verification independently.

# Derive a Lit Action Public Key Locally

## Question

I want to call `Lit.Actions.signAsAction`. I know the action identity is derived from the Action's IPFS CID, but I cannot find a way to obtain the public key outside of the Action runtime. `Lit.Actions.getActionPublicKey` works within the Action, while `executeJs` only exposes `signatures.<name>.publicKey` after a signing operation. Is there a way to deterministically derive the Action's public key locally without running the Action?
I want to call `Lit.Actions.signAsAction`. I know the action identity is derived from the Action's IPFS CID, but I cannot find a way to obtain the public key outside the Action runtime. `Lit.Actions.getActionPublicKey` works within the Action. However, `executeJs` only exposes `signatures.<name>.publicKey` after a signing operation. Is there a way to deterministically derive the Action's public key locally without running the Action?

## Answer

Yes. Inside the Lit Action you can deterministically derive the Action identity (and therefore its public key) from the same inputs the nodes use: the Action's IPFS CID and the signing scheme. The snippet below shows the complete flow:

1. Produce the 32-byte message hash the Lit nodes expect.
2. Call `Lit.Actions.signAsAction` to sign that message with the Action identity.
3. Derive the Action public key via `Lit.Actions.getActionPublicKey`, passing the Action CID and signing scheme.
3. Optionally derive the action public key via `Lit.Actions.getActionPublicKey`, passing the Action IPFS CID and signing scheme.
4. Optionally verify the signature with `Lit.Actions.verifyActionSignature`.
5. NOTE: `Lit.Actions.getActionPublicKey` and `Lit.Actions.verifyActionSignature` can be called from any Lit Action to verify signatures, not just from the same Action that called `Lit.Actions.signAsAction`.

```js
const { sigName, toSign } = jsParams; // 'publicKey' not required; derive it from the Action IPFS CID
Expand Down Expand Up @@ -72,7 +78,7 @@ This approach keeps the derivation entirely within the Lit Action context. Becau

## Derive the Same Public Key from Client Code

If you prefer to resolve the Lit Action public key outside of the Action runtime - e.g., inside tests or other tooling—the SDK now exposes a helper that calls the on-chain PubkeyRouter contract.
If you prefer to resolve the Lit Action public key outside the Action runtime - e.g., inside tests or other tooling—the SDK now exposes a helper that calls the on-chain PubkeyRouter contract.

```ts
import { createLitClient } from "@lit-protocol/lit-client";
Expand Down
Loading