The four-keypair Credential Payload

Each logical CRE8 Key receives these components.

1. Authentication keypair
K_auth_private
K_auth_public

Algorithm: Ed25519

Purpose:

Sign API requests.
Prove possession.
Prevent bearer-token authentication.
Bind request method, path, body digest, timestamp, nonce, and Credential ID.

It cannot:

Mint children.
Change permissions.
Sign authored content as an Author.
Decrypt messages.








==========================================







2. Delegation keypair
K_delegate_private
K_delegate_public

Algorithm: Ed25519

Purpose:

Sign child-minting requests.
Sign permission assignments.
Sign policy reductions.
Initiate child rotation.
Request child suspension or revocation.

It cannot by itself:

Perform routine API operations.
Publish authored content.
Decrypt messages.








==========================================







3. Authorship keypair
K_author_private
K_author_public

Algorithm: Ed25519

Purpose:

Sign authored objects.
Sign credentials or statements.
Sign versions and amendments.
Co-sign collaborative objects.
Establish provenance.

A publication API call should normally require both:

K_auth signature + K_author signature

Compromise of only the authorship key would therefore not let an attacker submit forged material through the live CRE8 API.








==========================================







4. Confidentiality keypair
K_box_private
K_box_public

Algorithm: X25519

Purpose:

Receive encrypted messages.
Receive encrypted shares.
Encrypt keyring packages.
Establish recipient-specific shared secrets.

It cannot:

Authenticate API requests.
Sign content.
Mint children.
Change policy.








==========================================







5. Credential ID
credential_id

A random, immutable, public identifier, for example:

cre8_k_7PK1BHZ4...

It is used to locate:

The logical Key.
Current component versions.
Public keys.
Status.
Policy.
Parent.
Descendants.
Historical signatures.

The Credential ID is never a password or bearer secret.