> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Sign and verify data
> Sign data and verify signatures with a key in Infisical KMS.
To sign data, send it to Infisical with a Sign/Verify key, and Infisical signs it with the key's private key. To verify the signature, send it back to Infisical, or give the key's public key to whoever needs to verify it.
## Prerequisites
* A [Sign/Verify key](/docs/documentation/platform/kms/keys#create-a-key)
* The **Member** role to follow the UI steps, or the **Cryptographic Operator** role to follow the API steps (see [Who can use a key](/docs/documentation/platform/kms/keys#who-can-use-a-key))
## Signing algorithms
When you sign or verify data, you choose a signing algorithm that matches the key's algorithm:
| Key algorithm | Signing algorithms |
| - | - |
| RSA-4096 | `RSASSA_PSS_SHA_256`, `RSASSA_PSS_SHA_384`, `RSASSA_PSS_SHA_512`, `RSASSA_PKCS1_V1_5_SHA_256`, `RSASSA_PKCS1_V1_5_SHA_384`, `RSASSA_PKCS1_V1_5_SHA_512` |
| ECC-NIST-P256, P384, and P521 | `ECDSA_SHA_256`, `ECDSA_SHA_384`, `ECDSA_SHA_512` |
| ED25519 | `ED25519` |
| ML-DSA-44, ML-DSA-65, and ML-DSA-87 | The same name as the key algorithm, such as `ML_DSA_65` |
RSASSA-PSS and ECDSA produce a different signature each time you sign the same data. RSASSA-PKCS1-v1.5 and Ed25519 always produce the same signature for the same data.
To list the signing algorithms for a key, call [the signing algorithms endpoint](/docs/api-reference/endpoints/kms/signing/signing-algorithms).
## Sign data
In your KMS project, go to **Overview**, select the options menu on the key's row, then select **Sign Data**.
Enter your data in **Data to Sign**, and pick a **Signing Algorithm**. If your data is already Base64 encoded, turn on **Data is Base64 encoded**.
Select **Sign**, then copy the signature from **Data Signature**.
Base64 encode your data, then call [the sign endpoint](/docs/api-reference/endpoints/kms/signing/sign) with the key's ID and a signing algorithm:
```bash theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/kms/keys//sign \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"data": "SGVsbG8sIFdvcmxkIQ==",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
}'
```
If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
The response contains the Base64-encoded signature:
```json theme={"dark"}
{
"signature": "",
"keyId": "",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
}
```
## Verify a signature
In your KMS project, go to **Overview**, select the options menu on the row of the key that signed the data, then select **Verify Data**.
Enter the data in **Data to Verify** and the signature in **Signature of Data**, then pick the **Signing Algorithm** that the data was signed with. If your data is already Base64 encoded, turn on **Data is Base64 encoded**.
Select **Verify**. **Signature Status** shows **Valid** if the signature matches the data, and **Invalid** if it doesn't.
Call [the verify endpoint](/docs/api-reference/endpoints/kms/signing/verify) with the ID of the key that signed the data:
```bash theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/kms/keys//verify \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"data": "SGVsbG8sIFdvcmxkIQ==",
"signature": "",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
}'
```
If you use EU Cloud or self-host Infisical, replace `https://app.infisical.com` with `https://eu.infisical.com` or the address of your instance.
In the response, `signatureValid` is `true` if the signature matches the data:
```json theme={"dark"}
{
"signatureValid": true,
"keyId": "",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
}
```
To verify signatures without calling Infisical, get the key's public key from [the public key endpoint](/docs/api-reference/endpoints/kms/keys/public-key).
## Sign a digest
If your data is large, or you don't want to send it to Infisical, you can hash the data yourself and sign the hash (the digest) instead. Digests work only with the `RSASSA_PKCS1_V1_5_*` and `ECDSA_*` signing algorithms.
Hash your data with the hash function in the signing algorithm's name, and Base64 encode the result. For example, for `RSASSA_PKCS1_V1_5_SHA_512`, create a SHA-512 digest:
```bash theme={"dark"}
echo -n "Hello, World" | openssl dgst -sha512 -binary | openssl base64 -A
```
Call [the sign endpoint](/docs/api-reference/endpoints/kms/signing/sign) with the digest as `data`, and add `"isDigest": true`:
```bash theme={"dark"}
curl --request POST \
--url https://app.infisical.com/api/v1/kms/keys//sign \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"data": "",
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512",
"isDigest": true
}'
```
To verify a signature over a digest, send the digest and `"isDigest": true` to [the verify endpoint](/docs/api-reference/endpoints/kms/signing/verify) in the same way.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.