Customer Integration Examples

These examples keep classical authorization and the final allow/deny decision in the customer backend. PQ Cloud adds ML-DSA-65 and registered-key policy verification; it does not replace the customer's existing controls.

Exchange withdrawal

const classicalOk = await existingWithdrawalChecks(withdrawal);
if (!classicalOk) return reject("classical authorization failed");

const result = await pq.verifyHybrid({
  payload,
  publicKeyHex,
  keyVersion: payload.key_version,
  mlDsa65SignatureHex: signature,
  classicalVerified: true,
});

if (result.valid !== true) return reject("PQ verification rejected");
return approveWithdrawal();

Treasury approval

classical_verified = treasury_policy_approved(request)
if not classical_verified:
    deny()

pq_result = verify_hybrid(canonical_payload, pq_evidence, classical_verified=True)
if pq_result != "Valid":
    deny()

execute_treasury_action()

Validator / backend authorization

if (!legacyAuthPassed) failClosed();

const verdict = await pq.verifyHybridEnvelope(envelope);
if (!verdict.valid) failClosed();

// Only now continue to the protected validator/backend action.
continueProtectedAction();

Fail-closed rules

• Timeout, network error, malformed response or missing verification result must never become Valid.
• classical_verified must be true only after the customer's own classical authorization succeeds.
• The exact canonical payload bytes signed by the customer must be the bytes represented in the verification request.
• Use registered public keys and controlled key-version rotation. Do not silently accept unknown or stale keys.
• The customer backend remains the final business-decision authority.

Recommended production sequence

1. Create a project and store the project API key only in server-side secret storage.
2. Register the ML-DSA-65 public key; keep the private key in the customer signer/HSM.
3. Set HybridRequired policy and allowed domain scope.
4. Perform classical authorization first.
5. Canonicalize, sign and submit the evidence to /v1/hybrid/verify.
6. Proceed only on an explicit authenticated valid: true response.