Aluchin API

curl -X POST https://aluchin.com/api/v1/verify \
  -H "X-API-Key: ak_YOUR_KEY_HERE" \
  -F "file=@invoice.pdf"

{
  "id": "a1b2c3d4e5",
  "hash": "e3b0c44298fc1c149afb...",
  "filename": "invoice.pdf",
  "verification_url": "https://aluchin.com/v/a1b2c3d4e5",
  "hedera_tx": "0.0.5144666@1706000000.000000000",
  "hashscan_url": "https://hashscan.io/testnet/transaction/...",
  "network": "testnet",
  "sequence_number": 42
}

X-API-Key: ak_YOUR_KEY_HERE

X-Session-Token: YOUR_SESSION_TOKEN

{
  "event": "verification.created",
  "timestamp": "2025-01-15T14:30:00.000Z",
  "data": {
    "id": "a1b2c3d4e5",
    "hash": "e3b0c44298fc1c149afb...",
    "filename": "invoice.pdf",
    "file_size": 245760,
    "verification_url": "https://aluchin.com/v/a1b2c3d4e5",
    "hedera_tx": "0.0.5144666@1706000000.000000000",
    "hashscan_url": "https://hashscan.io/mainnet/transaction/...",
    "network": "mainnet",
    "sequence_number": 42
  }
}

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return signature === expected;
}

// In your Express handler:
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-aluchin-signature'];
  if (!verifyWebhook(req.body, sig, WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  const payload = JSON.parse(req.body);
  console.log('Verified:', payload.data.filename);
  res.sendStatus(200);
});

import hmac, hashlib

def verify_webhook(body: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

# In your Flask handler:
@app.route('/webhook', methods=['POST'])
def webhook():
    sig = request.headers.get('X-Aluchin-Signature')
    if not verify_webhook(request.data, sig, WEBHOOK_SECRET):
        return 'Invalid signature', 401
    data = request.json
    print(f"Verified: {data['data']['filename']}")
    return '', 200

import requests

API_KEY = "ak_YOUR_KEY_HERE"
BASE = "https://aluchin.com/api/v1"

# Verify a file
with open("invoice.pdf", "rb") as f:
    res = requests.post(
        f"{BASE}/verify",
        headers={"X-API-Key": API_KEY},
        files={"file": f}
    )

data = res.json()
print(f"Proof: {data['verification_url']}")
print(f"TX:    {data['hedera_tx']}")

# Check a file later
with open("invoice.pdf", "rb") as f:
    check = requests.post(f"{BASE}/check", files={"file": f})

if check.json()["verified"]:
    print("Document is authentic.")
else:
    print("WARNING: Document has been tampered with!")

const fs = require('fs');

const API_KEY = 'ak_YOUR_KEY_HERE';
const BASE = 'https://aluchin.com/api/v1';

async function verifyFile(filePath) {
  const file = fs.readFileSync(filePath);
  const base64 = file.toString('base64');

  const res = await fetch(`${BASE}/verify`, {
    method: 'POST',
    headers: {
      'X-API-Key': API_KEY,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      file: base64,
      filename: filePath.split('/').pop()
    })
  });

  const data = await res.json();
  console.log('Proof URL:', data.verification_url);
  return data;
}

verifyFile('invoice.pdf');

# Verify
curl -s -X POST https://aluchin.com/api/v1/verify \
  -H "X-API-Key: ak_YOUR_KEY" -F "file=@doc.pdf" | jq .verification_url

# Check
curl -s -X POST https://aluchin.com/api/v1/check -F "file=@doc.pdf" | jq .verified

1. Generate invoice PDF
2. POST /verify with the PDF  →  get verification_url
3. Store verification_url in your database alongside the invoice
4. Email client: "Your invoice is verified: {verification_url}"
5. Auditor: re-upload PDF to /check  →  confirmed authentic

1. Contract finalized and signed
2. POST /verify with signed PDF  →  get verification_url + hedera_tx
3. Embed proof link in contract metadata or cover letter
4. Years later: re-upload to /check  →  proves document unchanged

1. Create compliance record / report
2. POST /verify  →  permanent blockchain proof
3. Store verification_url in compliance database
4. Auditor verifies via /check or visits proof page directly
5. HashScan link proves the record on Hedera's public ledger

{
  "error": "Monthly verification limit reached",
  "usage": 10,
  "limit": 10,
  "plan": "free",
  "upgrade_url": "https://aluchin.com/#pricing"
}

{
  "error": "No file provided. Send as multipart/form-data or JSON { file: \"<base64>\" }"
}