Get started

Overview

This guide explains the basic steps to start using the Signing Agent.

You will build and run a Signing Agent Docker image, add the Agent as a Member to your Policy, and transfer some testnet assets between two Vaults in your Workspace. The Signing Agent will automatically approve your transaction.

Prerequisites

Before you start, take these steps in the Qredo Web App:

1. Create a Qredo profile.
2. Create a Workspace.
3. In the Workspace settings, enable testnet assets.
4. Create a Portfolio.
5. Create two Vaults in your Workspace:
   • Specify the same testnet asset for both Vaults.
   • Select the Default Policy to govern them.
6. Get testnet assets to one of the Vaults. You can use faucets.

Step 1: Get an API key & secret

1. In the Qredo Web App, navigate to Workspace settings.
2. Click Create API key.
3. Select the Read/Write access.
4. Click Create API key. If this option isn't visible to you, just contact us here.
5. Copy and save your API key and secret.

Step 2: Build a Docker image

1. Clone the Signing Agent repository to a local directory with your preferred command-line tool:

   git clone https://github.com/qredo/signing-agent.git
    Copy

2. Install and run Docker.

3. In the command line, go to the signing-agent directory (the root of the repository) and build a Docker image:

   ./build.sh docker_latest
    Copy

   Check the Images tab in Docker: you will see a new image called signing-agent.

4. Create a volume directory in any location and make sure you have read & write access:

   Linux/Mac

   mkdir volume
    Copy

   Docker will use this directory as a persistent data storage.

5. Copy the config-template.yaml file from the signing-agent directory to the volume directory and rename it to config.yaml.

   This file contains settings of your Signing Agent. Later you will edit it to adjust the settings.

Step 3: Start the image

1. In the command line, go to the signing-agent directory and start the Signing Agent Docker image:

   docker run -ti --rm -v {path-to-the-volume-directory}:/volume -p 8007:8007 signing-agent:latest
    Copy

   This command also mounts the volume directory you created before into a Docker container.

2. Check the messages returned by the command line and make sure that the Signing Agent hasn't yet started automatically approving transactions:

   Agent Service: agent is not yet configured, auto-approval not started
    Copy

   Don't close the window where the image is running: otherwise it'll be stopped. Later you can revisit if to read the Signing Agent logs.

Step 4: Register the Agent

1. In the Web App, navigate to your Workspace and copy the Workspace ID from the URL:

   https://qredo.network/app/workspace/{workspaceID}
    Copy

2. Use the Signing Agent API endpoint GET /register. In the request body, specify your API key & secret and the Workspace ID you've just copied:

   curl -X 'POST' \
   'http://localhost:8007/api/v2/register' \
   -H 'accept: application/json' \
   -H 'Content-Type: application/json' \
   -d '{
     "APIKeyID": "YOUR_API_KEY_ID",
     "secret": "YOUR_API_SECRET",
     "workspaceID": "YOUR_WORKSPACE_ID"
   }'
    Copy

3. In the Web App, edit your Default Policy to add your API key (identified by name) as a second Member and set the Threshold to 1 of 2. Alternatively, you can use the Qredo API, as explained here: Add the API key to a Transaction Policy.

   When you registered the Signing Agent, it has been associated with your API key, so here the key represents the Agent.

   We don't recommend setting the 2 of 2 threshold. There is a risk of locking your assets in the wallet in case one of the members is no longer able to approve transactions.

4. Check the logs in the window where the Signing Agent image is running:

   agent registered, starting the service
   AutoApprover: listening
   WebsocketSource: connected to feed wss://api-v2.qredo.network/api/v2/actions/signrequests
   FeedHub: new feed client registered
   Start listening on HTTP
    Copy

Step 5: Approve a transaction

1. In the Web App, perform a transfer between your Vault holding testnet assets to the second Vault in your Workspace. Alternatively, you can use the Qredo API, as explained here: Create an EVM transaction.

2. If you initiated the transaction in the Web App, you may need to authorize it in the Signing App on your phone. Then Signing Agent will automatically approve the transaction. If the transaction was initiated programmatically, no action in the Signing App is required.

Check the logs in the window where the Signing Agent image is running:

AutoApprover: action `2WhocLMNygoxQ6iUlGbbkECmg1S` approved automatically`

Step 6: Configure the Agent

To configure the Signing Agent, do the following:

1. If the Signing Agent image is running, go to its window and terminate the process with Ctrl + C.

2. Open the config.yaml file stored in the volume directory. Adjust the file and save it.

3. To continue using the Signing Agent, start the image again, as described in Step 3.

For production usage, we strongly recommend adjusting the following settings::

• autoApproval: enabled: In this guide auto-approval was used for conducting a basic governance test. However for production environments it's advisable to disable it: just set this option to false.

• TLS: enabled: In a production setting it's crucial to set this option to true to ensure traffic encryption and secure data transfer.

• store: For testing purposes we're using the default text file /volume/ccstore.db to store the BLS private key, but for production we strongly recommend integrating with a key management service. See also: Qredo API: Security best practices.

Step 7: Start listening to a WebSocket feed

While the Signing Agent is running, it's using a WebSocket feed to track the activity associated with your account.

To see the feed, go to the window where the Signing Agent image is running. For example, after authorizing a transaction, you'll see details of the action waiting for approval:

{
  "id": "2WhocLMNygoxQ6iUlGbbkECmg1S",
  "type": 8,
  "status": 1,
  "description": "",
  "approverID": "a.48wq3YZk8TVvfJMEqkDJc5LPrvB7fqh9WDkkcemu6sQ3",
  "dataID": "",
  "senderID": "p.EoTuBtxCqjEUUV2LtzxURQADJUmshmTzj8CtYeo6bn5p",
  "payload": "eyJmZWVzIjogMTAwMCwgIm5vdGUiOiAiIiwgInR4SUQiOiAiMldob2F3MU9FMjBuNFdGTnRGcEpUZkZMamhkIiwgImFzc2V0IjogIkVUSC1HT0VSTEkiLCAiYW1vdW50IjogMjAwMDEwMDAsICJ2YXVsdElEIjogIjJyQVN1OTVadmg0c3lGampQczNKRDRoUXlRTDNEZ0xURVJEYWV2aUJ3S29pIiwgImFjY291bnRJRCI6ICIyV1VOS2E2ZVdDRk1EY2dCZWhsUEdOYWtVSzUiLCAiZXhwaXJlc09uIjogMTY5NzIwODYzOSwgIm5ldEFtb3VudCI6IDIwMDAwMDAwLCAicmVjaXBpZW50IjogeyJ0eXBlIjogIndvcmtzcGFjZSIsICJhZGRyZXNzIjogIjB4Y0Q3M2NiMWMyOTRiZTU2Q2JkNTQ0QmY3ZGQ0NkQyMDdmNjIzYzU4MyIsICJ2YXVsdElEIjogIjM4UmJmNnVHQUZNYUNaR1VoTUtKZXRDdVZoZE1RN21HOW5KeTlEOEhlZkd2IiwgImFjY291bnRJRCI6ICIyV1VOS2E2ZVdDRk1EY2dCZWhsUEdOYWtVSzUiLCAidmF1bHROYW1lIjogInRlc3QyIiwgInJlY2lwaWVudHMiOiBbeyJmZWUiOiAwLCAiYW1vdW50IjogMjAwMDAwMDAsICJ2YXVsdElEIjogIjM4UmJmNnVHQUZNYUNaR1VoTUtKZXRDdVZoZE1RN21HOW5KeTlEOEhlZkd2In1dLCAiYWNjb3VudE5hbWUiOiAidGVzdCIsICJ3b3Jrc3BhY2VJRCI6ICIyV0dBdE9PVEx0NXJ2Zlp3dHNpMWNuQlpvT00iLCAid29ya3NwYWNlTmFtZSI6ICJ0ZXN0In0sICJyZWZlcmVuY2UiOiAiIiwgInZhdWx0TmFtZSI6ICJ0ZXN0IiwgImFjY291bnROYW1lIjogInRlc3QiLCAid29ya3NwYWNlSUQiOiAiMldHQXRPT1RMdDVydmZad3RzaTFjbkJab09NIiwgInRyYW5zZmVyVHlwZSI6ICJ0cmFuc2Zlck91dCIsICJpbml0aWF0ZWRUaW1lIjogMTY5NzE5NDIzOSwgIndvcmtzcGFjZU5hbWUiOiAidGVzdCIsICJpbml0aWF0b3JEZXRhaWxzIjogeyJlbWFpbCI6ICJtYXJnYXJpdGEuc2tvbW9yb2toQHFyZWRvLmNvbSIsICJ1c2VySUQiOiAicC5Fb1R1QnR4Q3FqRVVVVjJMdHp4VVJRQURKVW1zaG1Uemo4Q3RZZW82Ym41cCIsICJsYXN0TmFtZSI6ICJTa29tb3Jva2giLCAiZmlyc3ROYW1lIjogIk1hcmdhcml0YSJ9fQ==",
  "messages": [
    "CAUSIBtz0+q/UXDJ1LCqvrKflSqRKhzP9iVP3aCg8+tTI8WNGiDWSrNHbkdljge6K//UxsI2bzUfv6/omWhOqQXXPzppiSgEMoMBCgVBZG1pbhJ6CA0SFygoYWRtMSA+IDApIHwgKGcxID4gMCkpGigKBGFkbTESIGEG/qWRx0kllwY6AyLKf0oPfGwwrzAKSQfnyNZ95UKvGiYKAmcxEiCYYq+MG28OYbCMWOGI4lZldBc66eqbwFw7ejpIWNtnmyILZGVzY3JpcHRpb24yRgoGU2V0dGxlEjwIAhIIKGcxID4gMCkaJgoCZzESIJhir4wbbw5hsIxY4YjiVmV0Fzrp6pvAXDt6OkhY22ebIgZzZXR0bGUyTgoMVHJhbnNmZXJQdXNoEj4IBBIIKGcxID4gMCkaJgoCZzESIJhir4wbbw5hsIxY4YjiVmV0Fzrp6pvAXDt6OkhY22ebIgh0cmFuc2ZlclIgPo3liIEqETlX/Nnz0LtPLt1swOF/Y7Yy6CL5/bYLfslaEmR5bmFtaWMgaGlsbCBjaGFsa2IgHVrtz3kJleJ4JufxApliXLMy4O74xhz8y9VHcOau4LdoEHpQCEEiTAogH55AhWl8ZOyVrzTk8X4bq6vly53CDHQSKAm7nq5pXBsQgNrECRogH55AhWl8ZOyVrzTk8X4bq6vly53CDHQSKAm7nq5pXBtA6Ac="
  ],
  "signatures": null,
  "timestamp": 1697194250,
  "actionSubject": null,
  "actionTime": 0,
  "expireTime": 1697208639,
  "metadata": "e30=",
  "created": 0
}
 Copy

Step 8: Start using the Signing Agent API

While the Signing Agent image is running, you can use the Signing Agent API.

For example, to check the Signing Agent status, use GET /healthcheck/status. Run the following in the command line:

curl -X GET 'http://localhost:8007/api/v2/healthcheck/status'
 Copy

This endpoint returns the WebSocket feed URL and other details:

{"websocket":{"readyState":"OPEN","remoteFeedURL":"wss://ms-api-dev.qredo.net/api/v2/actions/signrequests","connectedClients":0},"localFeedURL":"ws://0.0.0.0:8007/api/v2/client/feed"}
 Copy