Signing Module
The RTGS.global Signing Module provides message authenticity for all communication with the platform — both outbound API requests you send and inbound webhook events you receive.
Every request to the Participant API must carry a digital signature generated by the Signing Module. Equally, every webhook event that RTGS.global delivers to you is signed by the sender, and the Signing Module verifies that signature before your application processes it. Together, these two flows ensure that neither side can receive or act on a tampered or forged message.
The signing module consists of three components:
| Component | Role |
|---|---|
aries-admin-api | Internal wallet operations and signing |
aries-didcomm-agent | Encrypted DIDcomm callbacks from the network; must be internet-accessible |
signing-module-api | The Signing API your application calls to sign and verify messages |
Container images are published to rtgspublic.azurecr.io.
How it works
Signing outbound requests
Before sending any request to the Participant API, your application calls the Signing Module to produce a signature over the request body. The signature is attached as the rtgs-global-sig HTTP header.
Verifying synchronous responses
Responses from the Participant API are signed by RTGS.global. For endpoints that return data (such as GET requests), your application passes the response body and its signature to the Signing Module to verify authenticity before processing.
Webhook delivery with Svix
Svix is the webhook delivery service embedded in the Signing Module. It handles reliable outbound delivery of signing events to your configured endpoint(s), with automatic retries, delivery logs, and failure alerting.
You configure one or more webhook endpoints when deploying the Signing Module. Each endpoint has a unique identifier and URL.
Before you begin
The following values are provided in your RTGS.global onboarding welcome email:
| Value | Description |
|---|---|
| RTGS.global ID | Your organisation identifier — format RTGS:B:####### |
| Invitation | Base-64 encoded string that establishes your connection to the network |
| Jurisdiction | The RTGS.global jurisdiction you are connecting to |
| Wallet Seed | A secret you generate that establishes your cryptographic identity — keep this secure |
Your wallet seed cannot be recovered if lost. Store it in a secrets manager before deploying.
Deployment Options
| Option | Best for |
|---|---|
| Docker Compose | Local development and single-host environments |
| Helm | Kubernetes clusters (any cloud or on-premises) |
| EKS | Amazon EKS with automated prerequisite install and Route 53 DNS |
| AWS CloudFormation | Full AWS infrastructure (ECS Fargate, RDS, EFS, ALBs) |
| Azure Marketplace | Managed deployment into your Azure subscription |