EdgeNFC
Sign in Start free

EdgeNFC Documentation#

EdgeNFC turns any NTAG 424 DNA tag into a forgery-proof seal. Every tap generates a fresh, single-use cryptographic code that is verified at the edge, near your customer — typically in well under a second, anywhere in the world. This portal covers the three ways to integrate, the product playbooks, and the developer reference.

Note

New here? Start with Choose your path below, then follow the guide that matches how you want to run verification. Every guide ends in a runnable "verify it worked" step.

Choose your path#

Pick the integration that fits your team. All three converge on the same verification core.

PathAudienceYou runStart here
A — Hosted GatewayNon-technicalNothing (SaaS)Hosted quickstart
B — DIY Edge CoreDevelopersThe Wasm coreDIY Edge Core
C — Android provisioningWhoever encodes tagsThe app + your keyAndroid provisioning

The end-to-end lifecycle#

The same sequence underpins every path — provision once, then each tap is verified at the edge. This is the canonical lifecycle diagram, reused from the marketing site so the docs never drift from it.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

How verification works#

A tag signs each tap with a per-tag key derived via AN10922 from your System Master Key. The tap URL carries the UID, a monotonic counter, and an AES-CMAC. The edge recomputes the MAC and rejects any clone, replay, or forgery.

https://edgenfc.com/t?sys=<system>&uid=<uid>&ctr=<counter>&mac=<cmac>

Use cases#

Deciding whether EdgeNFC fits your product? Start with the one closest to yours:

Playbooks#

Once you can verify a tap, wire it into your product:

Reference#

  • REST API — the /verify contract, auth, errors, and rate limits.