Store Machine Data

Generate and sign machine data, store it in peaq storage, and update the machine’s DID Document with data references and administrator approval.

Once your machine has a wallet and a DID Document on peaq, the next step is to link its data to that on-chain identity. This gives you verifiable storage of machine data with admin approval, and traceability of what the machine produced.

In this section you will:

• Simulate data generated by a machine.
• Sign that data with the machine’s private key.
• Store the data in peaq storage.
• Update the DID Document with a reference to the signed data and its storage location.

You can use any other decentralized or traditional storage backend instead of peaq storage. The requirement is that the storage reference is linked through the machine’s DID Document, so others can verify where the data came from. See Off-Chain Storage Solutions.

Prerequisites

Before proceeding, ensure you have the following in place:

• peaq JavaScript SDK installed.
• A completed machine onboarding flow (see the previous page Onboard a Machine).
• A basic understanding of blockchain transactions, DIDs, and public/private key cryptography.

Instructions

This guide builds on the code from Onboard a Machine, which covered creating a wallet, transferring tokens, and registering a DID Document with an ECDSA verification method.

Here you simulate data output from a machine (a sensor reading or a device log), sign it with the machine and admin private keys, and store the result in peaq storage. Then you update the DID Document with a link to the signed data so others can verify and reference it.

1. Generating Machine Data

First, simulate a machine generating data and store it in peaq storage as a key-value pair.

Reuse the ECDSAKeyring class from the previous page to access the machine’s wallet. With it you:

• Generate mock data, as if produced by a sensor or onboard system.
• Store the unsigned message in peaq storage under a randomly generated UUID key.

JavaScript EVM

import { randomUUID } from "node:crypto";
import { Wallet } from "ethers";
import { Sdk } from "@peaq-network/sdk";

// Reuse the ECDSAKeyring class from previous page
class ECDSAKeyring {
    constructor(privateKey) {
      if (privateKey) {
        this.wallet = new Wallet(privateKey);
      } else {
        this.wallet = Wallet.createRandom(); // generates new key
      }
    }
    getAddress() {
      return this.wallet.address;
    }
    getPrivateKey() {
      return this.wallet.privateKey;
    }
    async signMessage(message) {
      return this.wallet.signMessage(message);
    }
}

// Simulate machine-generated data and store it in peaq storage
async function storeData(machineWallet){
    const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public"; // agung testnet

    const sdk = await Sdk.createInstance({
        baseUrl: HTTPS_BASE_URL,
        chainType: Sdk.ChainType.EVM
    });

    const key = randomUUID(); // Autogenerate a uuid that will be linked in DID Doc
    const message = "mock data to be stored"; // Replace with dynamic data if needed

    const tx = await sdk.storage.addItem({
        itemType: key,
        item: message
    });

    const receipt = await Sdk.sendEvmTx({
        tx: tx,
        baseUrl: HTTPS_BASE_URL,
        seed: machineWallet.getPrivateKey()
    });
    
    console.log(`Stored message for ${key}: "${message}"`)
    return message;
}

async function main(){	
    const MACHINE_PRIVATE = "0xMACHINE_PRIVATE_KEY"; // Replace with your machine key
	// Get the previously created wallet via the private key
    const machineWallet = new ECDSAKeyring(MACHINE_PRIVATE);
		
    // Store 'generated' data at peaq storage
    const message = await storeData(machineWallet);
}

main();

peaq storage holds a 64-byte key and a 256-byte value. For larger datasets or binary formats, use an alternative storage solution.

2. Sign Machine Data

Next, sign that message with the machine’s private key. This proves the machine produced the data.

The signature uses ECDSA, the signature algorithm native to EVM chains. It is later embedded in the DID Document so third parties can verify the message using:

• The machine’s public key (on-chain)
• The unsigned message (from peaq storage)
• The signature (in the DID Document)

JavaScript EVM

// Reuse the ECDSAKeyring class from the previous section

async function signData(message, machineWallet){
    return await machineWallet.signMessage(message);
}

async function main(){	
    const MACHINE_PRIVATE = "0xMACHINE_PRIVATE_KEY"; // Replace with your machine key
	// Get the previously created wallet via the private key
    const machineWallet = new ECDSAKeyring(MACHINE_PRIVATE);

    // Same data value that was stored previously
    const message = "mock data to be stored";

    // Sign data
    const signature = await signData(message, machineWallet);
}

main();

3. Admin Approve Machine Data

The administrator is the trusted authority for the machine. By signing a canonical representation of the stored data, the admin creates a verifiable link between the machine data and the party that controls the machine. A verifier can then confirm both where the data came from and that the responsible party endorsed it.

The administrator:

• Retrieves the stored machine data, identified by the UUID used in peaq storage.
• Prepares a canonical JSON representation of the data to sign.
• Signs the canonical content with the admin private key.
• Sends the transaction that stores the signed approval.

JavaScript EVM

import { Sdk } from "@peaq-network/sdk";

// Reuse the ECDSAKeyring class from the previous section

// Store machine data approval in peaq storage using the admin wallet
async function storeData(adminWallet, machineWallet, key, machineSignature) {
  const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public"; // agung testnet

  // Prepare the content to be approved. Be wary about the 256 byte limit.
  const storageContent = {
    storageKey: key,
    machineSignature: machineSignature
  };

  const sdk = await Sdk.createInstance({
    baseUrl: HTTPS_BASE_URL,
    chainType: Sdk.ChainType.EVM
  });

  // We reuse the same uuid key to link the machine data with the admin approval.
  const tx = await sdk.storage.addItem({
    itemType: key,
    item: storageContent
  });

  // The admin sends the transaction to store the approval.
  const receipt = await Sdk.sendEvmTx({
    tx: tx,
    baseUrl: HTTPS_BASE_URL,
    seed: adminWallet.getPrivateKey()
  });

  console.log(`Admin stored approval for ${key}`);
  // Return the content that will be signed by the admin.
  return storageContent;
}

// The admin signs the canonical representation of the stored data.
async function adminSignData(adminWallet, unsignedContent) {
  const canonicalContent = JSON.stringify(unsignedContent);
  return await adminWallet.signMessage(canonicalContent);
}

async function main() {  
  const MACHINE_PRIVATE = "0xMACHINE_PRIVATE_KEY"; // Replace with your machine key
  const ADMIN_PRIVATE = "0xADMIN_PRIVATE_KEY"; // Replace with your admin key
  // Get the machine wallet instance via its private key.
  const machineWallet = new ECDSAKeyring(MACHINE_PRIVATE);
  // Get the admin wallet instance (trusted authority).
  const adminWallet = new ECDSAKeyring(ADMIN_PRIVATE);

  // The key used to store the machine data (generated previously).
  const key = "uuidValue"; // Autogenerated uuid from before
  const machineSignature = "0xSIGNATURE_VALUE"; // Machine signature from previous step
    
  // Admin stores the approval data in peaq storage.
  const unsignedContent = await storeData(adminWallet, machineWallet, key, machineSignature);

  // The admin signs the canonical content to approve the machine-generated data.
  const adminSignature = await adminSignData(adminWallet, unsignedContent);

  console.log("Admin Signature:", adminSignature);
}

main();

The admin signature covers the canonical JSON of the stored machine data, which includes the storage key and the machine’s signature. It is the proof that the trusted authority approved the data, and the next step writes it into the machine’s DID Document.

4. Update DID Document

Both signatures exist and both unsigned messages are in peaq storage, so the last step is to update the machine’s DID Document. The update embeds the admin approval in the DID, so anyone can resolve the DID, fetch the unsigned message, and check both signatures.

In this step you:

• Reuse the machine’s original DID (same name and wallet).
• Keep existing fields such as the verification method.
• Add a signature field with:
  • The algorithm (EcdsaSecp256k1RecoveryMethod2020).
  • The issuer (the admin address).
  • The admin signature hash over the canonical data.
• Update the services field with a reference to the unsigned message in peaq storage, keyed by the UUID.

JavaScript EVM

import { Sdk } from "@peaq-network/sdk";

// Reuse the ECDSAKeyring class from the previous section

async function updateDID(machineWallet, adminWallet, key, adminSignature){
  const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public"; // Agung testnet endpoint
  const WSS_BASE_URL = "wss://wss-async-agung.peaq.xyz";        // Used to read previously stored DID

    const sdk = await Sdk.createInstance({
        baseUrl: HTTPS_BASE_URL,
        chainType: Sdk.ChainType.EVM
    });

    const name = "project_name"; // Same name as before
    
    const customFields = {
        verifications: [{
            type: "EcdsaSecp256k1RecoveryMethod2020"
        }],
        signature: {
          type: "EcdsaSecp256k1RecoveryMethod2020",
          issuer: adminWallet.getAddress(),
          hash: adminSignature
        },
        services: [
          {
            id: '#unsignedMessage',
            type: 'peaqStorage',
            data: key // Reference to the stored unsigned admin & machine data in peaq storage
          },
          {
            id: '#admin',
            type: 'admin',
            data: adminWallet.getAddress()
          },
        ]
    };

    // Create a transaction object to update the DID
    const tx = await sdk.did.update({
        name: name,
        address: machineWallet.getAddress(),
        wssBaseUrl: WSS_BASE_URL,
        customDocumentFields: customFields
    });

    // Submit the transaction to the network using the machine’s private key
    const receipt = await Sdk.sendEvmTx({
        tx: tx,
        baseUrl: HTTPS_BASE_URL,
        seed: machineWallet.getPrivateKey()
    });

    console.log("DID Document updated with receipt:", receipt);
}

async function main(){	
    const MACHINE_PRIVATE = "0xMACHINE_PRIVATE_KEY"; // Replace with your machine key
    const ADMIN_PRIVATE = "0xADMIN_PRIVATE_KEY"; // Replace with your admin key
	// Get previously created wallet via the private key
    const machineWallet = new ECDSAKeyring(MACHINE_PRIVATE);
    const adminWallet = new ECDSAKeyring(ADMIN_PRIVATE);
    const key = "uuidValue"; // Autogenerated uuid from before
    const adminSignature = "0xSIGNATURE_VALUE"; // admin signature from previous step

    // Same data value that was stored previously
    await updateDID(machineWallet, adminWallet, key, adminSignature);
}

main();

The DID Document now carries the admin signature and points at the unsigned machine data in peaq storage. Anyone can read the DID Document, fetch the message from peaq storage by its UUID, and verify it against both the machine’s public key and the admin attestation.

Putting it all Together

This script ties the steps into one flow:

1. Initialize wallets: create instances for the machine and the admin with ECDSAKeyring.
2. Generate and store machine data: the machine generates mock data and stores it in peaq storage under a random UUID.
3. Sign machine data: the machine signs the data with its private key.
4. Admin approval: the admin stores an approval object in peaq storage, then signs its canonical JSON.
5. Update DID Document: the DID Document gets the admin signature and the reference to the stored data.

JavaScript EVM

import { randomUUID } from "node:crypto";
import { Wallet } from "ethers";
import { Sdk } from "@peaq-network/sdk";

// Reuse the ECDSAKeyring class from previous page
class ECDSAKeyring {
    constructor(privateKey) {
      if (privateKey) {
        this.wallet = new Wallet(privateKey);
      } else {
        this.wallet = Wallet.createRandom(); // generates new key
      }
    }
    getAddress() {
      return this.wallet.address;
    }
    getPrivateKey() {
      return this.wallet.privateKey;
    }
    async signMessage(message) {
      return this.wallet.signMessage(message);
    }
}

// Simulate machine-generated data and store it in peaq storage
async function storeMachineData(key, machineWallet){
    const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public"; // agung testnet

    const sdk = await Sdk.createInstance({
        baseUrl: HTTPS_BASE_URL,
        chainType: Sdk.ChainType.EVM
    });

	const message = "mock data to be stored"; // Replace with dynamic data if needed

    const tx = await sdk.storage.addItem({
        itemType: key,
        item: message
    });

    const receipt = await Sdk.sendEvmTx({
        tx: tx,
        baseUrl: HTTPS_BASE_URL,
        seed: machineWallet.getPrivateKey()
    });
    
    console.log(`Stored message for ${key}: "${message}"`)
    return message;
}

async function signMachineData(message, machineWallet){
  return await machineWallet.signMessage(message);
}


// Store machine data approval in peaq storage using the admin wallet
async function storeAdminApproval(adminWallet, machineWallet, key, machineSignature) {
  const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public"; // agung testnet

  // Prepare the content to be approved. Be wary about the 256 byte limit.
  const storageContent = {
    storageKey: key,
    machineSignature: machineSignature
  };

  const sdk = await Sdk.createInstance({
    baseUrl: HTTPS_BASE_URL,
    chainType: Sdk.ChainType.EVM
  });

  // We reuse the same key to link the machine data with the admin approval.
  const tx = await sdk.storage.addItem({
    itemType: key,
    item: storageContent
  });

  // The admin sends the transaction to store the approval.
  const receipt = await Sdk.sendEvmTx({
    tx: tx,
    baseUrl: HTTPS_BASE_URL,
    seed: adminWallet.getPrivateKey()
  });

  console.log(`Admin stored approval for ${key}`);
  // Return the content that will be signed by the admin.
  return storageContent;
}

// The admin signs the canonical representation of the stored data.
async function adminSignData(adminWallet, unsignedContent) {
  const canonicalContent = JSON.stringify(unsignedContent);
  return await adminWallet.signMessage(canonicalContent);
}

async function updateDID(machineWallet, adminWallet, key, adminSignature){
  const HTTPS_BASE_URL = "https://peaq-agung.api.onfinality.io/public";
  const WSS_BASE_URL = "wss://wss-async-agung.peaq.xyz";        // Used to read previously stored DID

    const sdk = await Sdk.createInstance({
        baseUrl: HTTPS_BASE_URL,
        chainType: Sdk.ChainType.EVM
    });

    const name = "project_name"; // Same name as before
    const customFields = {
        verifications: [{
            type: "EcdsaSecp256k1RecoveryMethod2020"
        }],
        signature: {
          type: "EcdsaSecp256k1RecoveryMethod2020",
          issuer: adminWallet.getAddress(),
          hash: adminSignature
        },
        services: [
          {
            id: '#unsignedMessage',
            type: 'peaqStorage',
            data: key // Reference to the stored unsigned admin & machine data in peaq storage
          },
          {
            id: '#admin',
            type: 'admin',
            data: adminWallet.getAddress()
          },
        ]
    };

    // Create a transaction object to update the DID
    const tx = await sdk.did.update({
        name: name,
        address: machineWallet.getAddress(),
        wssBaseUrl: WSS_BASE_URL,
        customDocumentFields: customFields
    });

    // Submit the transaction to the network using the machine’s private key
    const receipt = await Sdk.sendEvmTx({
        tx: tx,
        baseUrl: HTTPS_BASE_URL,
        seed: machineWallet.getPrivateKey()
    });
    console.log(`Successfully Updated DID Document`);
}

async function main(){	
    const MACHINE_PRIVATE = "0xMACHINE_PRIVATE_KEY"; // Replace with your machine key
    const ADMIN_PRIVATE = "0xADMIN_PRIVATE_KEY"; // Replace with your admin key
	// 1. Initialize Wallets
    const machineWallet = new ECDSAKeyring(MACHINE_PRIVATE);
	const adminWallet = new ECDSAKeyring(ADMIN_PRIVATE);

	// 2. Generate & Store Machine Data
    const key = randomUUID();
	const message = await storeMachineData(key, machineWallet);
    
    // 3. Sign Machine Data
    const machineSignature = await signMachineData(message, machineWallet);

    // 4. Admin Approval
    const unsignedContent = await storeAdminApproval(adminWallet, machineWallet, key, machineSignature);
    const adminSignature = await adminSignData(adminWallet, unsignedContent);

    // 5. Update DID Document
    await updateDID(machineWallet, adminWallet, key, adminSignature);
}

main();

Summary

After running this script, your machine’s DID Document holds:

• A reference to the storage entry that the admin wrote to peaq storage.
• The admin’s signature attesting to the data.

The storage entry itself holds the machine’s signature over the data.

That is a verifiable data trail: anyone can resolve the DID Document, retrieve the stored data by its key, and confirm that both the machine and the admin signed it.