Auth & Approval Concepts

Actors & responsibilities

BlockPeer Trade APIs
        ↓
IntegratingSystem
        ↓
EndUser (Authorized Signer)

BlockPeer

• Provides TradeTrust-compliant APIs
• Orchestrates document lifecycle
• Hosts approval and signing screens
• Never custodies keys or signs

Integrating System

• Calls BlockPeer APIs
• Manages business workflows
• Redirects End Users for approval
• Remains the system of record

End User

• Reviews eBL / ETR actions
• Approves actions using passkeys
• Signs only via redirect URL
• Retains legal control

Authentication (what it does)

Authentication:

• Identifies the End User
• Issues a session token
• Enables workflow initiation

Authentication does not:

• Approve actions
• Sign documents
• Transfer legal control

Approval (what really matters)

Approval is mandatory for every:

• eBL issuance
• eBL transfer or endorsement
• eBL surrender or return
• Any other ETR management action

How approval works (non-negotiable)

1. Integrating System initiates an eBL / ETR action
2. BlockPeer returns a redirect URL
3. Integrating System redirects the End User
4. End User reviews the action
5. End User approves using passkeys only
6. Action is completed and control is updated

There is no alternative approval path.

Passkeys as the only approval mechanism

• Passkeys are mandatory for approval
• No passwords, private keys, or seed phrases are exposed
• No API-based signing is allowed
• No background or delegated signing is supported

This guarantees:

• Explicit consent
• Strong authentication
• Legal enforceability of control

Network transaction fees (context)

• Approved actions result in TradeTrust registry updates
• Registry updates may require network transaction fees
• Fees are paid from the End User-controlled account

BlockPeer does not currently abstract network fees.

Why this matters for enterprises

• Clear separation of duties
• No custody risk
• No blockchain development required
• Strong audit and compliance posture
• Seamless integration with existing systems

Summary

• Authentication = identity
• Approval = legal control
• Approval happens only via redirect URL
• Approval uses End User passkeys only
• BlockPeer never signs or custodies