Guide: the public verify page

/verify is a zero-integration, keyless verification surface — paste an intent token or drop an attested photo and get a cryptographic verdict, entirely in the browser. It's the fastest way to show someone that a Provenance proof is real, and every evidentiary artifact can deep-link to it.

Two checks, both client-side

Intent token — pastes into the page, which fetches the issuer's JWKS and runs ES256 verification with WebCrypto. No API key, no server round-trip (the in-browser verification is the demo). If the token is authentic, the page also does a keyless revocation check against GET /v1/public/intent-status/{jti}, which returns only { "revoked": bool }.

Media file — drop a JPEG; the page extracts the embedded attestation bundle from its XMP segment and verifies the bundle's ECDSA-P256 signature against the public key in its device certificate. The file never uploads — it's read with the File API and processed locally.

Both paths use the same browser-safe primitives shipped in @provenance/sdk (verifyIntentTokenOffline, verifyAttestedImageOffline), so you can build the same experience into your own app.

Deep links

/verify?token=<intent token> pre-fills and verifies on load — use it in emails, PDFs, and dashboards so a recipient can confirm a proof in one click.

What the page checks

In the browser, the page checks authenticity, expiry and revocation for tokens, and signature authenticity for photos. Intent-token payload binding and a photo's full certificate chain, sensor hash and risk score run in the authenticated POST /v1/intent/verify and POST /v1/claims/verify APIs.

Why it's free

Verification is free by design. Every verified token, evidentiary export, and approval email that links here spreads the token format as a de-facto standard — that's the point.