Developers

curl -X POST https://receiz.com/api/document-seal \
  -F "file=@invoice.pdf" \
  -F "visualStamp=0"

// Seal any file while preserving original format semantics.
const sealForm = new FormData();
sealForm.append("file", fileInput.files[0]);

const sealed = await fetch("https://receiz.com/api/document-seal", {
  method: "POST",
  body: sealForm,
});
const sealedBlob = await sealed.blob();
const verifyPath = sealed.headers.get("x-receiz-verify-path");

// Verify deterministic result from the sealed artifact bytes.
const verifyForm = new FormData();
verifyForm.append("file", new File([sealedBlob], "artifact.receized"));

const verify = await fetch("https://receiz.com/api/document-verify", {
  method: "POST",
  body: verifyForm,
});
const result = await verify.json();
if (!verify.ok) {
  throw new Error(result.errors?.[0] ?? "document_verify_failed");
}

// Canonical response keys are always present:
// ok, kind, errors, warnings, bundle, anchor, package
const { ok, kind, errors, warnings, bundle, anchor, package: pkg } = result;
console.log(ok ? "verified" : "rejected", kind, verifyPath, {
  errors,
  warnings,
  hasBundle: Boolean(bundle),
  hasAnchor: Boolean(anchor),
  packageItems: pkg?.itemCount ?? 0,
});

<!-- Sign in with Receiz button -->
<button id="receiz-signin" type="button" class="receiz-signin-trigger">
  <img src="https://receiz.com/sign-in-with-receiz.svg" alt="Sign in with Receiz" width="240" height="44" />
</button>

<style>
  .receiz-signin-trigger {
    border: 0;
    background: transparent;
    padding: 0;
    line-height: 0;
    cursor: pointer;
  }
  .receiz-signin-trigger img {
    display: block;
    width: 240px;
    height: 44px;
  }
</style>

<script type="module">
  // Sign with Receiz guarantees:
  // - Passkey is default auth ceremony
  // - Email magic-link is fallback or optional login method
  // - New users are auto-provisioned on first successful sign-in
  // - Passkey + email converge to the same Receiz identity (same OIDC sub)
  const RECEIZ_ISSUER = "https://receiz.com";
  const RECEIZ_CLIENT_ID = "YOUR_RECEIZ_CLIENT_ID";
  const REDIRECT_URI = "https://yourapp.com/auth/receiz/callback";
  const SCOPE =
    "openid profile email offline_access receiz:record receiz:seal receiz:verify receiz:wallet.read receiz:wallet.transfer";

  const b64u = (bytes) =>
    btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

  async function createPkce() {
    const verifierBytes = crypto.getRandomValues(new Uint8Array(32));
    const verifier = b64u(verifierBytes);
    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
    const challenge = b64u(new Uint8Array(digest));
    return { verifier, challenge };
  }

  async function startReceizLogin(loginHintEmail) {
    const discovery = await fetch(`${RECEIZ_ISSUER}/.well-known/openid-configuration`).then((r) => r.json());
    const { verifier, challenge } = await createPkce();
    const state = crypto.randomUUID();
    const nonce = crypto.randomUUID();

    sessionStorage.setItem("receiz:pkce_verifier", verifier);
    sessionStorage.setItem("receiz:state", state);
    sessionStorage.setItem("receiz:nonce", nonce);

    const auth = new URL(discovery.authorization_endpoint);
    auth.searchParams.set("response_type", "code");
    auth.searchParams.set("client_id", RECEIZ_CLIENT_ID);
    auth.searchParams.set("redirect_uri", REDIRECT_URI);
    auth.searchParams.set("scope", SCOPE);
    auth.searchParams.set("state", state);
    auth.searchParams.set("nonce", nonce);
    auth.searchParams.set("code_challenge", challenge);
    auth.searchParams.set("code_challenge_method", "S256");

    if (loginHintEmail) auth.searchParams.set("login_hint", loginHintEmail.trim().toLowerCase());
    location.assign(auth.toString());
  }

  document.getElementById("receiz-signin")
    ?.addEventListener("click", () => startReceizLogin());
</script>

// /api/auth/receiz/callback (Node/Express example)
import express from "express";
import fetch from "node-fetch";

const app = express();
const RECEIZ_ISSUER = "https://receiz.com";
const CLIENT_ID = process.env.RECEIZ_CLIENT_ID!;
const CLIENT_SECRET = process.env.RECEIZ_CLIENT_SECRET!;
const REDIRECT_URI = "https://yourapp.com/auth/receiz/callback";

app.get("/auth/receiz/callback", async (req, res) => {
  const code = String(req.query.code || "");
  const state = String(req.query.state || "");
  const expectedState = req.session.receizState;
  const verifier = req.session.receizPkceVerifier;

  if (!code || !state || !verifier || state !== expectedState) {
    return res.status(400).send("receiz_oauth_state_invalid");
  }

  const discovery = await fetch(`${RECEIZ_ISSUER}/.well-known/openid-configuration`).then((r) => r.json());
  const tokenRes = await fetch(discovery.token_endpoint, {
    method: "POST",
    headers: { "content-type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code",
      code,
      redirect_uri: REDIRECT_URI,
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
      code_verifier: verifier,
    }),
  });
  const token = await tokenRes.json();
  if (!tokenRes.ok || !token.access_token) {
    return res.status(401).send(token.error || "receiz_token_exchange_failed");
  }

  const userInfoRes = await fetch(discovery.userinfo_endpoint, {
    headers: { authorization: `Bearer ${token.access_token}` },
  });
  const profile = await userInfoRes.json();
  if (!userInfoRes.ok || !profile.sub) {
    return res.status(401).send("receiz_userinfo_failed");
  }

  // Upsert your app user by stable OIDC subject. Store receiz_sub permanently.
  // First login should create your local app user automatically if missing.
  // Receiz guarantees passkey and email converge to one receiz_sub per user.
  const appUser = await db.users.upsertByReceizSub({
    receiz_sub: profile.sub,
    email: profile.email || null,
    name: profile.name || null,
    raw_profile: profile,
  });

  req.session.userId = appUser.id;
  req.session.receizAccessToken = token.access_token;
  req.session.receizRefreshToken = token.refresh_token || null;
  return res.redirect("/app");
});