EMAIL PROVIDERS
Email that carries authority, not just a sender
UniKey is built on the same primitives that secure legitimate email: DKIM signing and keys published in DNS. Email providers already verify which domain sent a message. With UniKey they can also verify that a request inside it, a bank change, a payment or an approval, was authorized by a person.
THE PROBLEM TODAY
Credentials stand in for permission
Business email compromise
A convincing email asks finance to change a supplier's bank details or pay an invoice. DKIM proves the domain sent it, not that anyone authorized the request.
Hijacked mailboxes
A compromised mailbox sends perfectly signed mail, and every request it sends looks legitimate.
Approval by reply
A reply saying "approved" is treated as authority, though anyone with access to the thread can write it.
WITH UNIKEY
Actions that carry a Trust Packet
Each one is signed by the party with the authority to take it, and verified before it executes.
-
Sign the request, not just the message
A Trust Packet in the email names the exact action, recipient and limits, signed from the requester's device.
-
Verify at the inbox
The provider checks the packet on arrival and marks requests that carry no valid authority before anyone acts on them.
-
Approve from the device
An approval comes back as its own signed packet, not as a reply anyone could type.
-
Hand off to the receiving system
The ERP or bank verifies the same packet itself, with no integration with the email provider.
{
"action": "update_supplier_bank",
"subject": "accounts@wilson-supply.com",
"signer": "wilson-supply.com",
"audience": "ap@acme-corp.com",
"params": {
"channel": "email",
"supplier_id": 42,
"new_account_last4": "7788"
},
"expires_at": "2026-10-05T14:05:00Z"
}
Illustrative. The verifier looks up the signer's public key in DNS, checks the Ed25519 signature, refuses a packet it has seen before or one past its expiry, and only then lets the action run.
DEMO VIDEOS
See it in related recordings
UDA's ERP takes supplier bank-change requests by email and holds each one until it is verified. The ERP recordings on the demo videos page show it at work.