> For the complete documentation index, see [llms.txt](https://docs.learncard.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.learncard.com/understand/decentralized-identifiers-dids/signing-authorities.md).

# Signing Authorities

Every credential is signed by a private key. A **signing authority** is a key that signs *on your behalf* — so `send()` can produce credentials issued by you without your server ever holding the key.

## Why it exists

Two things want to sign credentials as you but shouldn't have your seed:

* **LearnCard itself**, when you send from a template, use the Developer Portal, or run an embedded app. There's no code of yours in the loop to do the signing.
* **A separate service**, when your organization runs its own signing infrastructure and wants LearnCard to call it rather than hand keys around.

A signing authority solves both. You register a signer — its endpoint, a name, and its DID — against your profile. From then on, when the network needs to issue something as you, it asks that signer.

## Two kinds

|                   | **Hosted**                                                                                             | **Your own**                                                           |
| ----------------- | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------- |
| Who holds the key | LearnCard, tied to your profile                                                                        | You, on a server you run                                               |
| How you create it | One click in the Developer Portal, or `createSigningAuthority()`                                       | Deploy a [VC-API](https://w3c-ccg.github.io/vc-api/) `/issue` endpoint |
| Then              | `registerSigningAuthority()` + `setPrimaryRegisteredSigningAuthority()` — the Portal does both for you | Same two calls, with your endpoint                                     |
| Choose it when    | You'd rather not manage keys; you use templates or API tokens                                          | Compliance or policy requires your keys to stay on your infrastructure |

Almost everyone wants **hosted**. The setup walkthrough is [Who Signs Your Credentials?](/build/send-credentials/create-signing-authority.md)

## What the credential looks like

The credential's `issuer` is still **you** — your profile's DID. The `proof` is made by the signing authority's key, which your registration has authorized to sign for that DID. Verifiers resolve your DID, find the authority's key among its verification methods, and the signature checks out. Recipients see your name and logo, not the authority's.

## How it's used

```mermaid
sequenceDiagram
    participant You as Your server
    participant Net as LearnCard Network
    participant SA as Signing authority
    You->>Net: send({ templateUri, recipient })
    Net->>Net: look up your primary signing authority
    Net->>SA: sign this credential as <your DID>
    SA-->>Net: signed credential
    Net->>Net: deliver
```

You can register several authorities; `send()` always uses the one marked **primary**. Auto-issued credentials from a [consent contract](/understand/consentflow-overview/auto-boosts.md) name their authority explicitly in the contract.

If you pass a `signedCredential` to `send()` instead of a template, no signing authority is involved — you already signed it.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.learncard.com/understand/decentralized-identifiers-dids/signing-authorities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.