Introducing P256: Unforgeable Signature for Any Machine running peaqOS

A drone lands on a charging pad. The pad has exactly one question: are you the drone you claim to be?

In the old world, the answer is a password, an API key, or a QR code someone has to scan. All of them are shared secrets. All of them can be copied, leaked, or handed to the wrong machine.

In the new world, the drone signs a challenge with a private key that has never left the secure element soldered to its board. peaq verifies that signature onchain. The pad unlocks. Nobody types anything.

Start building with P-256 verification → https://docs.peaq.xyz/peaqchain/build/advanced-operations/p256-signature-verification

The Signature Problem Machines Have Always Had

A machine can already prove who it is on peaq. Every robot running peaqOS wakes up with a peaq ID, omnichain wallets, and a Machine NFT — and from there it can discover and pay for real services through peaqOS Scale and robotic.sh.

What has been harder is proving that a specific action — this order, this transaction, this command, this data packet — came from the physical device itself, and not from something impersonating it.

The industry's usual answer is a credential stored in software: an API key in a config file, a token from a central authentication server. Copy the file, clone the machine. Take the server offline, and every machine downstream stops working.

Meanwhile the hardware already ships with a better answer. Secure elements, TPMs, and mobile secure enclaves are designed to keep keys non-exportable under normal operation, and sign with them on demand. Many widely deployed systems converge on one curve: P-256, also known as secp256r1. It is the curve behind passkeys and FIDO2, Apple’s Secure Enclave, Android’s hardware keystore, automotive controllers, and is widely supported across robotics and industrial IoT stacks.

Until now that signature stopped at the edge of the chain. peaq could not check it natively, so builders had to route around it.

Until now that signature stopped at the edge of the chain. peaq could not check it natively, so builders had to route around it.

P-256, on-chain on peaq

peaq now verifies P-256 signatures through a smart contract. A machine signs a payload with the key inside its secure hardware, and any developer, contract, service provider, or counterparty can confirm onchain that the signature came from the hardware bound to that machine's peaqOS identity.

Developers can verify signatures on:

• Blockchain transactions
• Machine-to-machine service requests and orders on robotic.sh
• Machine-generated data
• Commands sent to infrastructure
• Payloads signed by a robot or machine using P-256

This is not a second identity system sitting next to peaq ID. It extends the identity a machine already has with the signing hardware it already ships with. If your fleet has a secure element, the integration path is short: sign the payload on the device, verify it onchain.

P-256 Verfication on peaq:

What Changes When the Chip Signs

A machine on peaqOS produces a lot of signed activity in a day. Hardware-backed signatures change what a counterparty can prove about each kind of it.

→ The money it moves. A payment carries the same guarantee as the identity behind it. The wallet is not authorized by a credential sitting in a config file; it is authorized by a key that cannot leave the chip.

→ The data it produces. peaqOS Stream already signs data at the moment of capture. P-256 answers the harder question buyers ask: not just which identity signed this frame, but which physical device. Provenance that reaches the silicon is worth more than provenance that stops at the software layer.

→ The services it buys. A machine running peaqOS discovers and pays for real services through robotic.sh — positioning, compute, edge inference, agent commerce. Signed orders mean a provider can meter and rate-limit against a device that cannot be cloned, and an operator can audit consumption down to the individual unit.

→ The commands it receives. An instruction to an industrial controller, a gate, a charger, or a fleet is only as safe as the proof of who issued it. That proof now lives in hardware.

→ The record it builds. A Machine Credit Rating is only as good as the history behind it. Jobs, payments, and datasets that each carry a hardware-backed signature make a track record an underwriter can price.

And it points at what comes next. peaqOS Verify — cryptographic attestation of a machine's own provenance, firmware, and history — is the function that pushes trust all the way down to the factory floor. Onchain P-256 verification is the groundwork it stands on.

Showcase: A Drone That Pays for Its Own Charge

Here’s what this looks like in a real-world scenario: a drone flies to a charging station and handles the entire session autonomously.

→ Step 1: Challenge. The drone arrives. The station issues a cryptographically random, one-time nonce that expires after a short period.

→ Step 2: Hardware signature. The drone signs the challenge with the P-256 private key held in its secure element. The key never leaves the chip.

→ Step 3: Onchain verification. peaq verifies the signature onchain, proving the request came from that specific drone's hardware.

→ Step 4: Autonomous payment. The drone authorizes a USDT payment for the session using Tether's Wallet Development Kit, signing with the same hardware-backed keys it used to prove its identity.

→ Step 5: Charging. Payment confirms. The station unlocks. Charging begins.

No password. No API key. No QR code. No human within a hundred meters of the pad.

The payment is the point, and also the proof: once a machine can sign with hardware the chain trusts, that same signature can move money, buy a service, authorize a command, and settle the bill.

What It Unlocks

P-256 support means peaq meets the robotics, automotive, and industrial hardware world on cryptography it already runs, rather than asking it to adopt something new. For builders, that turns into:

• Hardware-backed signatures for robots and machines, rooted in a key that cannot be exported.
• Onchain verification of any machine-generated signature, checkable by any contract or counterparty.
• Service consumption on robotic.sh tracked and auditable down to the physical unit.
• Cryptographically authenticated machine-to-machine interactions, with no central authentication server in the path.
• Hardware-signed blockchain transactions, so payments carry the same guarantee as identity.
• Secure authorization of real-world services — charging, docking, refueling, access, tolls.
• A short integration path for existing robotics, industrial, automotive, and IoT fleets.

The practical effect: a robot you did not build, made by a manufacturer you have never spoken to, can prove itself to your infrastructure, buy what it needs, and leave a receipt you can verify. That is what an open Machine Economy needs to work.

Where P-256 Sits in the Stack

→ Activate. Every robot and machine onboarded with a peaq ID, omnichain wallets, and a Machine NFT. Live.

→ Scale. Each one discovering and paying for services and Machine Money Markets through robotic.sh. Live.

→ Stream. Each one turning its data into a signed, verifiable asset and delivering it end-to-end. Live.

→ Qualify. Each one carrying a dynamic Machine Credit Rating any counterparty can check. Live.

→ Monetize, Verify, Tokenize. Coming next.

P-256 verification runs underneath all of them. Identity makes payments possible. Payments create a record. The record becomes credit. Hardware-backed signatures are what make each link in that chain something a counterparty can check rather than something they have to believe.

Start Building

Every transaction, order, command, and data packet a machine produces needs an answer to the same question the charging pad asked: did the hardware actually sign this?

With native P-256 verification, peaq answers it onchain — for machines that already carry the keys.

Read the docs and start verifying hardware-backed signatures → https://docs.peaq.xyz/peaqchain/build/advanced-operations/p256-signature-verification

Explore the services your machines can buy → https://robotic.sh/