Integrating JLINC into your application
The JLINC Server is the official way to run the JLINC Core API and JLINC Archiver services.
Core service
- Custom and pre-configured agreements for data transfer
- Cryptographic signing of data for provenance and data authenticity protections
- A data store for storing cryptographically signed records
Archiver service
- Zero-knowledge third-party storage of audit records
These services can be self-hosted, or you can take advantage of our cloud hosted solution which includes multiple pricing options.
Be sure to read the Getting started with JLINC section to choose the best option for your organization before continuing here.
Usage
The following examples show how to use the JLINC Server API features in your application. In these examples, the token/archiveToken variables are the API keys acquired from the JLINC Server UI.
Step 1: Creating identities
Each user or element of your system needs an identity, or a way to manage cryptographic keys. JLINC handles this all for you.
Step 2: Signing agreements
After creating identities for users and/or elements in your system, a Verifiable Contractual Agreement (VCA) can be used to define how data should be used and exchanged.
Step 3: Exchanging data
When two entities exchange data, such as a user typing into a chatbot, an AI agent handing off data to an MCP tool, or any other systematic data exchange, JLINC generates a cryptographically signed event record that occurs under the governance of the VCA, and a Zero-Knowledge Audit (ZKA) record that can be used for future auditing.
Step 4: Zero-knowledge auditing
When an audit needs to take place, a local JLINC Server can retrieve ZKAs from a 3rd-party server which can be used to validate data provenance and integrity to ensure nothing has been modified in the system.
Bonus: Fine-grained access control
In addition to general API authentication via the bearer token, the JLINC server endpoints all support fine-grained access control via AuthZEN formatted requests. This means the JLINC server can return a denial if a user, AI tool, or system element does not have required permissions to complete the activity. We can even connect to many existing authorization platforms if you already have your own.