Getting on the Trust List

# Private key (keep secret) + raw 32-byte public key as base64url-RAW (unpadded, -_):
openssl genpkey -algorithm ed25519 -out my-ocss-key.pem

b64url() { python3 -c "import sys,base64;print(base64.urlsafe_b64encode(sys.stdin.buffer.read()).decode().rstrip('='))"; }

# Public key X — this goes in the registration request:
PUB_B64URL=$(openssl pkey -in my-ocss-key.pem -pubout -outform DER | tail -c 32 | b64url)

# 32-byte seed — this is your SenderKey.seed for signing (keep secret; last 32 bytes of the PKCS#8 DER):
SEED_B64URL=$(openssl pkey -in my-ocss-key.pem -outform DER | tail -c 32 | b64url)

echo "PUB_B64URL=$PUB_B64URL"
echo "SEED_B64URL=$SEED_B64URL  # feed to b64urlRawDecode() → SenderKey.seed"

curl -X POST https://phosra-api-sandbox-production.up.railway.app/api/v1/advisors/self-register \
  -H "Content-Type: application/json" \
  -d "{\"did\":\"did:ocss:my-org\",\"public_key_b64url\":\"$PUB_B64URL\"}"

{
  "advisor_id":      "b125739f-…",                 // your Trust-List row id (stable UUID; safe to log)
  "did":             "did:ocss:my-org",
  "key_id":          "did:ocss:my-org#2026-07",  // your full signing key id (did#kid) — use verbatim
  "kid":             "2026-07",                    // the bare kid the census bound (current UTC month)
  "published_key_x": "FBdykqxNN2Lz…",              // echoes the public key you sent
  "trust_tier":      "provisional"
}

curl -s https://phosra-api-sandbox-production.up.railway.app/.well-known/ocss/trust-list \
  | python3 -c "import sys,json; d=json.load(sys.stdin); doc=json.loads(d['document']); \
print([e['jwks']['signing_keys'] for e in doc['entries'] if e['did']=='did:ocss:my-org'])"
# → [{'crv':'Ed25519','kid':'2026-07','kty':'OKP','x':'FBdykqxNN2Lz…'}]