> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quote.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Quote locks

> Verify the signed snapshot, not mutable UI text

The Ed25519 `dev.uqp.quoting.quote_lock` extension uses version `2026-11-05`. Discover verification keys at `https://api.quote.dev/.well-known/jwks.json`. The signed `quote_hash` binds the returned `locked_quote` snapshot.

Verify the signature with the identified key, recompute the snapshot hash, check quote identity and expiration, and compare integer amounts and currency before trusting a lock. A signature is not proof of payment capture. Sandbox locks use a public fixture key and must never be trusted as live credentials.

Verify agent webhook `X-QuoteDev-Signature` with HMAC-SHA256 over the raw request bytes before parsing or applying provider decisions. Keep signing secrets server-side. Quote locks describe the Layer-2 quote.dev contract; the upstream UQP protocol is external Apache-2.0 infrastructure.

[Quote lifecycle](https://docs.quote.dev/quotes-and-holds.md) · [API reference](https://api.quote.dev/reference)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.