---
title: Configure the verification client
description: Configure OrbitRail Verify with an API key, flush limit, signature algorithm, clock tolerance, signature age, and replay cache.
url: https://pr-4-f831df687d6c.thally.app/verify/configuration
---

# Configure the verification client

Configure OrbitRail Verify with an API key, flush limit, signature algorithm, clock tolerance, signature age, and replay cache.

Pass options to `createVerifyClient` to control batching, signature validation,
and replay detection:

```ts
const verifier = createVerifyClient({
  apiKey: process.env.ORBITRAIL_API_KEY!,
  flushLimit: 100,
  algorithm: "ed25519",
  clockToleranceSeconds: 30,
  maxSignatureAgeSeconds: 300,
  replayCacheSeconds: 600,
});
```

Every optional parameter has a default. Values outside the accepted range throw
a `RangeError` during client creation.

| Option                   | Required | Default         | Accepted values          | Description                                                                 |
| ------------------------ | -------- | --------------- | ------------------------ | --------------------------------------------------------------------------- |
| `apiKey`                 | Yes      | —               | non-empty string         | OrbitRail API key used to verify payloads                                   |
| `flushLimit`             | No       | `100`           | integer 1–1,000          | Verification items grouped in one batch                                     |
| `algorithm`              | No       | `"hmac-sha256"` | `hmac-sha256`, `ed25519` | Signature algorithm used for payload verification                           |
| `clockToleranceSeconds`  | No       | `30`            | integer 0–300            | Allowed clock skew in seconds for signed-timestamp validation               |
| `maxSignatureAgeSeconds` | No       | `300`           | integer 1–3,600          | Maximum signature age in seconds; older signatures are rejected             |
| `replayCacheSeconds`     | No       | `600`           | integer 60–3,600         | Duration a previously accepted signature fingerprint is cached for replay detection |