Quantized lets you mint licenses dynamically, without calling our API, using public/private key cryptography. You keep a private key secret and use it to sign short JSON payloads (JWTs) that identify a user and their license type. You upload only the matching public key to Quantized. When one of your signed tokens arrives as a Bearer token, we verify the signature against your public key and resolve (or lazily create) the corresponding license on the fly.

This means you can issue access to your users offline, at any scale, with zero round-trips to Quantized.

The keys we use

Quantized uses Ed25519 keys with the EdDSA signature algorithm (RFC 8032):

• Small, fast, and modern — a private key is ~32 bytes; signatures are 64 bytes.
• Deterministic signing: the same payload signed with the same key always produces the same token. (Signatures carry no randomness.)
• Keys must be provided in PEM format — public keys as SubjectPublicKeyInfo (-----BEGIN PUBLIC KEY-----), private keys as PKCS#8 (-----BEGIN PRIVATE KEY-----).

Keep your private key secret. Anyone with it can issue licenses on your behalf. Quantized only ever stores your public key.

Generating a key pair

Pick any of the following — they all produce a compatible PEM pair.

# Private key (keep secret)
openssl genpkey -algorithm ed25519 -out quantized_private.pem

# Public key (upload this one)
openssl pkey -in quantized_private.pem -pubout -out quantized_public.pem

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

private_key = Ed25519PrivateKey.generate()

private_pem = private_key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.PKCS8,
    encryption_algorithm=serialization.NoEncryption(),
).decode()

public_pem = private_key.public_key().public_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PublicFormat.SubjectPublicKeyInfo,
).decode()

print(public_pem)   # upload this

const { generateKeyPairSync } = require("crypto");

const { publicKey, privateKey } = generateKeyPairSync("ed25519");

console.log(publicKey.export({ type: "spki", format: "pem" }));    // upload this
console.log(privateKey.export({ type: "pkcs8", format: "pem" }));  // keep secret

Uploading your public key

1. Sign in to the Account Settings area of your Quantized dashboard.
2. Open Public Keys and choose Add public key.
3. Paste the full PEM contents of your quantized_public.pem (including the BEGIN/END lines) and save.

Each key is tied to your account and can be activated or deactivated at any time. You may keep multiple active keys — useful for rotation. If you have more than one active key, include the key’s ID as the kid field in your JWT header so we know which one to verify against.

Signing a license payload

A Quantized license token is a compact JWT: base64url(header).base64url(payload).base64url(signature).

Header:

{ "alg": "EdDSA", "typ": "JWT", "kid": "<public-key-id>" }

kid is optional if you only have one active key.

Payload — the minimum required fields:

* Provide at least one of user_id or license_id.

Optional fields:

Because signing is deterministic, a token with no exp/salt is stable — the same user always gets the same token. Add an exp for expiring tokens, or vary the salt when you need to rotate.

Example (Python):

import base64, json
from cryptography.hazmat.primitives.serialization import load_pem_private_key

def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()

def sign_license(payload: dict, private_key_pem: str) -> str:
    header = {"alg": "EdDSA", "typ": "JWT"}
    header_b64 = b64url(json.dumps(header, separators=(",", ":")).encode())
    payload_b64 = b64url(json.dumps(payload, separators=(",", ":")).encode())
    signing_input = f"{header_b64}.{payload_b64}".encode()

    key = load_pem_private_key(private_key_pem.encode(), password=None)
    signature = key.sign(signing_input)
    return f"{header_b64}.{payload_b64}.{b64url(signature)}"

token = sign_license(
    {
        "institution_id": "your-institution-id",
        "license_type_id": "your-license-type-id",
        "user_id": "user-123",
    },
    open("quantized_private.pem").read(),
)

Send the resulting token as a Bearer credential on any Quantized API call:

curl https://api.quantized.example/v1/chat/completions \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ "model": "...", "messages": [...] }'

Rotating and revoking

• Rotate keys: upload a new public key, switch your signing to it, then deactivate the old one in Account Admin.
• Revoke a token: deactivate the public key that signed it (revokes everything signed by that key), or manage the individual key from the dashboard.