Edge Platforms

PEAC Protocol packages run on all major edge and serverless platforms. The core crypto uses @noble/ed25519, which provides a pure JavaScript implementation with zero native dependencies -- making it portable across runtimes.

Cloudflare Workers

Issue and verify PEAC receipts directly in a Cloudflare Worker. Secrets are accessed through the env bindings.

worker.ts

import { issue, verifyLocal } from '@peac/protocol';

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const data = { message: 'Hello from PEAC' };
    const response = Response.json(data);

    const { jws } = await issue({
      iss: 'https://api.example.com',
      kind: 'evidence',
      type: 'org.peacprotocol/api-request',
      sub: request.headers.get('x-agent-id') || 'anonymous',
      privateKey: env.PEAC_PRIVATE_KEY,
      kid: 'peac-2026-03',
    });

    response.headers.set('PEAC-Receipt', jws);
    return response;
  },
};

Next.js

API Routes (App Router)

Issue receipts from Next.js API route handlers. Works with both the Edge Runtime and the Node.js runtime.

app/api/route.ts

import { issue } from '@peac/protocol';
import { NextResponse } from 'next/server';

export async function GET(request: Request) {
  const data = { message: 'Hello from PEAC' };

  const { jws } = await issue({
    iss: 'https://www.example.com',
    kind: 'evidence',
    type: 'org.peacprotocol/api-request',
    sub: 'api-consumer',
    privateKey: process.env.PEAC_PRIVATE_KEY!,
    kid: 'peac-2026-03',
  });

  return NextResponse.json(data, {
    headers: { 'PEAC-Receipt': jws },
  });
}

Middleware

Use Next.js middleware to intercept and verify incoming PEAC receipts on protected routes.

middleware.ts

import { verifyLocal } from '@peac/protocol';
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export async function middleware(request: NextRequest) {
  const receiptHeader = request.headers.get('PEAC-Receipt');

  if (receiptHeader) {
    const result = await verifyLocal(receiptHeader, {
      issuer: 'https://trusted-issuer.example.com',
    });

    if (!result.verified) {
      return NextResponse.json(
        { error: 'Invalid PEAC receipt' },
        { status: 401 }
      );
    }
  }

  return NextResponse.next();
}

export const config = {
  matcher: '/api/:path*',
};

Platform compatibility

Platform	Status	Runtime	Notes
Cloudflare Workers	Supported	V8 isolate	Web Crypto API
Next.js (Edge Runtime)	Supported	V8 isolate	Web Crypto API
Next.js (Node Runtime)	Supported	Node.js	Node.js crypto
Vercel Edge Functions	Supported	V8 isolate	Web Crypto API
Deno Deploy	Supported	V8 isolate	Web Crypto API
AWS Lambda	Supported	Node.js	Node.js 22+ required
AWS Lambda@Edge	Supported	Node.js	Node.js 22+ required

Key requirements

• Node.js >= 22.13.0 for server-side runtimes
• Ed25519 support in the platform's crypto API
• PEAC uses @noble/ed25519 v3, which provides a pure JavaScript fallback when native Ed25519 is unavailable. No native modules are required.

---

Express Middleware

Full Express.js integration with automatic receipt issuance.

MCP Server

Run PEAC as an MCP server for AI agent verification.

Installation

Get started with package installation and key generation.