Sign the exact intent.

01 / PREPARE

Start with the local tools

Use Node.js 24 on Linux or macOS and a reviewed source checkout or the independent reference kit. Extract the kit and open a terminal in its top-level folder, which contains nearby-protocol and public.

Check your installed Node version:

node --version

It should begin with v24.. The prebuilt verifier and Node’s built-in modules need no npm installation for the commands below. These instructions assume you are in the kit’s top-level folder.

The website cannot connect to your signer or access its keys. Run only source you have reviewed. The local computer, runtime, terminal and storage remain trusted; this is not hardware key isolation.

02 / CREATE TEST KEYS

Keep the passphrase in the terminal

node nearby-protocol/authority-cli.mjs init ./nearby-private

At the hidden terminal prompt, choose a unique passphrase of at least 16 characters. Keep it out of browser fields, command arguments, environment variables, logs and screenshots.

The command creates separate encrypted issuer and payer keys in a new nearby-private directory. It refuses to overwrite existing state. Record the printed public profile keys separately; those are the values the checker will need.

Both roles live on this laptop. This reference is for testing and has no key-recovery interface. Keep the passphrase and local state available for the rest of the test.

03 / GET THE REQUEST

Retain the receiver’s details separately

The receiver uses Signed exchange (new tab) to review and sign a request, then exports its .ereq file. This adapter accepts whole test credits on echo-demo-local, with scale 0.

Save that file as request.ereq in the kit’s top-level folder. Separately retain the full request ID and confirm the full receiver address through your trusted exchange. The incoming file cannot establish its own trust.

Keep the device clocks correct and the request valid while signing. A receiver may restrict the request to a specific payer; that address must match your local payer.

04 / REVIEW & SIGN

Approve only the exact test intent

node nearby-protocol/authority-cli.mjs sign ./nearby-private ./request.ereq ./payment.eauth

The terminal asks for the separately retained request ID, confirmed receiver address and your local passphrase. It then displays the proposed intent and permission ticket. Review the receiver, amount, request ID and time window before typing SIGN.

Approval happens before the five-second permit starts. That limit applies to signing; you do not have to transfer or inspect the file within five seconds.

A completed result is retained locally before payment.eauth is exported. The file contains public signed evidence, not private keys.

05 / CHECK EVIDENCE

Bring the file and confirmed public values

Return to your original Check authority evidence tab, or open the checker. Import payment.eauth, then enter the values you retained separately:

• Authority issuer public key.
• Delegate public key: the owner key in this local reference tool.
• Confirmed payer and receiver Echo addresses.
• The full request ID.

Choose Check permission evidence. A match establishes historical permission evidence and still says Pending Sync. It does not establish current revocation status, complete budget history, actual execution, funds or settlement.

After a match, choose Test an altered copy. A changed amount must be refused while the original evidence remains unchanged. The checker does not save evidence or trust values; retain the files and re-enter confirmed values after a reload.

IF AN EXPORT FAILS

Recover the retained result

Replace FULL_REQUEST_ID below with the full ID you retained. Re-exporting a completed result returns the same bytes without signing again:

node nearby-protocol/authority-cli.mjs export ./nearby-private FULL_REQUEST_ID ./retained.eauth

If the tool reports OUTCOME_UNKNOWN, keep the state and investigate. Do not delete the journal or create a new request to bypass the block. Output files are never overwritten.

TAKE THE GUIDE WITH YOU

Prepare before disconnecting

Open the standalone checker while online and choose Prepare offline copy. The prepared copy includes this guide and the verifier, but not your evidence, confirmed values or the surrounding website. Export the files you need first.

The full technical specification includes the exact signed fields, terminal inspection commands and implementation limits. Download the full specification (.md).