# Platform keys and health

> The public keys that sign price challenges and receipts, and the health check. None of these need an API key.

### `GET /health`

**No auth.** `{ status, instance, time }`. `instance` is the current challenge-signing key id.

### `GET /v1/platform/public-key`

The ed25519 public key that signs **402 challenges**: `{ publicKeyPem, signingKeyId }`. Clients check every challenge against it before signing a payment. The SDKs cache it.

### `GET /v1/platform/receipt-keys/:keyId`

The public key for a **receipt** signing key: `{ keyId, publicKeyPem }`. Old keys stay available after rotation, so an old receipt can always be checked. Returns `404` for an unknown key id.

## Verifying a signature yourself

Challenges, payment proofs and receipts are signed the same way:

1. Take the object and remove `signature` and `signingKeyId`.
2. Serialise it as **canonical JSON**: keys sorted at every level, no extra whitespace, amounts as strings.
3. Verify the base64 `signature` with ed25519 against the public key.

`verifyPayload(body, signature, publicKeyPem)` in `@zanora/core` does this.