This page shows exactly what you are approving. It checks every hash itself; the server and the console cannot change the script shown here.
Development profile: the instance ID is not pinned in config.json.
LoadingStarting the signing page...
Run PowerShell command
This step cannot be undone. It needs your passkey, every time.
Finding the server's words, not verified: the script below is what runs
Technician explanation hash verified
What the staff member sees hash verified
Passkey challenge = SHA-256 of the canonical envelope
Canonical envelope (the exact bytes hashed)
Start signing for this session
One passkey confirmation now. After it, each command you authorize in this session opens on this page, and it is signed only when you click Approve here, until the session ends or the time below. A step that cannot be undone asks for your passkey each time. The signing key is created here and cannot leave this page.
Passkey challenge = SHA-256 of the canonical session grant
Canonical session grant (the exact bytes hashed)
Session signing is on
Keep this window open. Each command you authorize in the console opens here for you to read and approve, and what you approve is listed below. If you close it, the console reopens it on the next command.
Signed in this window
Nothing signed yet.
Sign approved-technician list
Technicians
| Technician | Roles | Scope | Signing passkeys |
|---|
Groups
Clients
Revoked devices
Passkey challenge = SHA-256 of the canonical document
Full document
Create a signing passkey
New passkey fingerprint (SHA-256 of the public key, first 128 bits)
Algorithm: