Gatekeeper

Release keys

Banks that run gkcaptcha on their own servers install updates from Gatekeeper. Every update is signed. Your servers accept an update only if a key in the trust set below signed it. Pin this value once, and check it before you install an update.

Trust-set fingerprint

sha256:2c97f0c4c6953af76897c6059f66e7feaa9c6d090afda2ba9d2b9d46843137bf

Published: October 18, 2026

What this value covers

The value covers both release public keys, current.pub and next.pub, each in its role. If either key is replaced, or a key is added, the value changes. We publish only this one value. Record it as your pinned value and in the contract annex.

How to check it

  1. Open the trust folder of the update bundle. It holds current.pub and next.pub.

  2. In that folder, run this command:

    printf 'gk-trust-v1\n%s\n%s\n' "$(sha256sum current.pub | cut -d' ' -f1)" "$(sha256sum next.pub | cut -d' ' -f1)" | sha256sum | cut -d' ' -f1
  3. The command prints only the hex part. Compare it with the value above, after the sha256: prefix. Every character must match.

If the values differ

Do not install the update. Contact us before you take any other step.

Contact us

Key rotation

When we rotate the keys, we publish the new value on this page on the day of the rotation release. The update check prints the new value after NEW-FINGERPRINT. Compare it with this page before you record it as your new pinned value.