| API key | A named token with an expiry of 30, 60 or 90 days, generated in System Setup > User for non-interactive authentication. |
| API user credentials | The username, code (or passcode), and identity type that a client exchanges for a token. |
| Application | A project in App Management that groups certificates and the teams allowed to use them. The user who creates it is its owner. |
| Approval policy | The rule attached to an environment: Certificate Owner, Quorum or No Approval. |
| Audit Trail | The report of critical actions in four categories: Crypto Operations, Application Operations, User Management and System Settings. |
| Authentication certificate | A client certificate (PFX/P12) generated in System Setup > User. Build machines use it for mutual TLS with the server. |
| Certificate Owner (policy) | An approval policy where the owner of the certificate approves or denies each request. |
| Client-side hashing | The client calculates the file hash locally and sends only the hash for signing. |
| CSR | Certificate Signing Request. CodeSign Secure generates the key pair in the HSM and creates a CSR that you submit to a certificate authority. |
| ec-signer | The CodeSign Secure component used with cosign to sign container images. |
| EC KSP for Mac | The macOS signing client that lets codesign use keys held in CodeSign Secure. |
| Environment | A named context, such as Dev or Production, that carries an approval policy and an MFA setting. Each certificate is assigned to one environment. |
| EV certificate | An Extended Validation code-signing certificate issued by a public CA after stricter identity checks. |
| HSM | Hardware security module. The device that generates, stores and uses private keys. |
| Identity store | The Azure AD (Microsoft Entra ID) configuration used for single sign-on. |
| JWT | JSON Web Token. The token the server returns after authentication, sent as Authorization: Bearer <token>. |
| Key label (alias) | The name that identifies a key for signing tools, for example the /kc value for SignTool or the alias for jarsigner. |
| Key usage | The reproducible-build setting of a certificate: None, Pre-Sign Hash Validation or Post-Sign Hash Validation. |
| KSP | Key Storage Provider. The Encryption Consulting Windows CNG provider that SignTool and other Windows tools call to sign. |
| MFA | Multi-factor authentication. For approvals, a one-time code is sent by email to the approver. |
| No Approval | An approval policy where requests are signed without human approval. Typical for automated pipelines and test environments. |
| PKCS#11 Wrapper | The Encryption Consulting PKCS#11 library for Windows, Linux, and macOS signing tools. |
| Post-sign hash validation | Validation that runs after signing to confirm the signed artifact matches the expected build in Reproducible Build signing projects. Only for testing/development environments. |
| Pre-sign hash validation | Validation that runs before signing to confirm the artifact matches a trusted rebuild in Reproducible Build signing projects. Signing happens only if the hashes match. |
| Quorum | An approval policy where a minimum number of eligible approvers must approve a request. |
| Reproducible build | A build that produces identical output from the same source, so a trusted rebuild can confirm an artifact before or after signing. |
| Signing project | The configuration in System Setup that defines the repository, branch and Jenkins server used for reproducible-build validation. |
| Signing request | A request to sign one hash with one certificate, created each time a client signs. |
| Support package | A diagnostics bundle created from Profile > Maintenance for Encryption Consulting support. |
| Team | A group of users allowed to sign with the certificates mapped to it in an application. |
| Timestamp / TSA | A trusted time proof from a Time Stamping Authority that keeps signatures valid after the certificate expires. CodeSign Secure uses public TSAs. |
| Utility Tool | The Encryption Consulting Windows command-line tool for single-file and bulk signing. |
