EdgeNFC
Sign in Start free

Event Access & VIP Credentials#

The problem#

The fraud vector at a door is not a master forger — it is a screenshot. A barcode or QR pass can be photographed, forwarded and presented by five people, and the door staff cannot tell which one is the buyer. Your options today are a hard-to-scan hologram, an ID check that slows the line, or eating the loss.

How EdgeNFC solves it#

Each wristband or card carries a per-tag key and a monotonic counter. Every tap produces a different code, and the counter it carries must be higher than the last one the server saw.

  • A duplicate is detectable. Present the same tap twice — a screenshot, a forwarded link, a relayed URL — and the second one fails verification with reason: non_monotonic. There is no window in which the copy is as good as the original.
  • A clone is not mintable. Producing a fresh valid code needs the tag's key, which is diversified per tag and never leaves the chip. See Key management & security.
  • The check is fast and server-side. Verification happens at the edge, close to the door — typically in well under a second — and the counter check is not something a client can be talked out of.

How it works here#

Provision the wristbands once before the event; every tap at the gate is verified at the edge.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

What you need#

PieceWhat to pick
HardwareNTAG 424 DNA tags — no other chip works. CR80 cards for VIP and staff passes; adhesive wet inlays for wristbands and lanyards; a rigid token or epoxy disc where the credential has to survive an outdoor weekend. Where to buy
PlanCreator for custom routing (send each tier to its own page); Brand for scan-frequency and geo analytics across the gates
SoftwareThe provisioning app to encode the batch; the hosted gateway for the door check — a staff device or the guest's own phone, both hitting the same verification

Step by step#

  1. Create one system per event. All of that event's credentials derive their keys from that system's master key.
  2. Encode the batch with the provisioning app. Each credential lands in your registry with its UID and key version.
  3. Route by tier. Point the system at a general "Welcome" page, then use per-tag routing (Enterprise) to send VIP, artist or staff tags to their own destination. The destination is owner-stored config, never taken from the tag or the URL — so a forged tap can't be steered anywhere at all.
  4. Run the door. Staff taps the credential (or the guest self-scans). An authentic, counter-advancing tap opens the destination; a duplicate does not.
  5. Reuse the tags. The credentials are not consumed by the event — re-point the same system at next season's page, or revoke individual tags, without re-writing hardware.

Important

Decide the human response to "already used" before doors open. The server gives you a hard fact — this tap did not advance the counter — but whether that means deny, pull aside, or escalate to a supervisor is your operational policy, not a cryptographic one. Legitimate reasons for a re-presented tap exist (a re-entry lane, a mis-tap that already registered), so write the rule down and brief staff on it.

Verify it worked#

  • Tap a genuine credential: authentic, with read_ctr one higher than the previous tap.
  • Copy the tap URL and open it again — the classic screenshot attack: not authentic, reason: non_monotonic, no redirect. Do this once in front of the door team; it is the whole pitch in five seconds.
  • Revoke a test tag, then tap it: it stops verifying immediately, with no hardware change.
  • On Brand+, check the analytics for that system and confirm the authentic/failed split moved.

Known limits#

Warning

Plan for the Android tap-dispatch quirk at the gate. Android 16+ can't NDEF-dispatch NTAG 424 DNA tags — a Google regression — so a guest's own phone may do nothing when it touches the credential. The workaround is to scan from inside the EdgeNFC app. For a door line, that argues for a staff device running the app as the primary check rather than relying on whatever phone the guest brought.

Start free#

Provision a test batch on the free Sandbox plan and run the duplicate-tap demo before you commit to an order.

Start free →