EdgeNFC
Sign in Start free

Luxury Goods & Collectibles#

The problem#

A watch, a handbag or a graded collectible is worth what its story can prove. Today that story lives in a paper certificate that can be forged, a warranty card that gets lost, and a service booklet that stops at the first resale. The secondary market absorbs the doubt as a discount, and the brand loses contact with the object the moment it leaves the boutique.

How EdgeNFC solves it#

The digital twin: the tag proves the object, the portal holds the record, and the counter shows the interaction history.

  • The tag proves the object. Each tap carries a fresh code signed with a per-tag key diversified from your System Master Key. A photograph of the certificate proves nothing; a tap that verifies proves the physical item is present.
  • The portal holds the record. Because verification happens before anything is shown, an authentic tap can be the gate on the material that matters — certificate of authenticity, service history, warranty registration, concierge contact.
  • The counter shows the history. The monotonic read counter advances on every genuine tap and can never go backwards, so a replayed or copied URL is rejected as non_monotonic.
  • Privacy is available where the item is sensitive. In encrypted-PICC mode the tag's UID is encrypted inside the URL rather than mirrored in plaintext, so a passer-by reading the tag learns nothing that identifies the item.

How it works here#

Provision at manufacture or at authentication, then every tap over the object's life runs the same verification.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

What you need#

PieceWhat to pick
HardwareNTAG 424 DNA tags — no other chip works. A 30 mm epoxy disc or rigid token for hangtags and cases; CR80 cards for the certificate card itself; adhesive wet inlays for embedding into packaging or a lining. Where to buy
PlanBrand for a custom verification domain and geo/scan analytics; Enterprise for the management API, per-tag routing and multi-user access
SoftwareThe provisioning app to encode items; the management API to keep the registry in step with your ERP or authentication workflow

Step by step#

  1. Create a system per line or per collection, and choose encrypted-PICC mode if you do not want the item's UID readable in plaintext by anyone standing next to it.
  2. Encode at the point of authentication — at manufacture, at final QC, or when a specialist authenticates a consignment. The tag's UID and key version land in your registry.
  3. Bind the record. Route the item's tag to its own destination (per-tag routing, Enterprise) so the tap opens that item's record. The destination is owner-stored config, never taken from the tag or the URL.
  4. Update the record over the object's life — a service, a re-authentication, a change of destination — through the management API, with no need to touch the hardware again.
  5. Revoke on loss or theft. A revoked tag stops verifying immediately, and every change is written to a non-secret audit trail.

Verify it worked#

  • Tap the item: authentic, and the record opens. Tap it again: authentic, with the counter one higher — that increment is the object's interaction history accruing.
  • Replay a captured tap URL: not authentic, reason: non_monotonic.
  • Re-point a single tag through the management API and confirm the next tap lands on the new record, with nothing re-written on the tag.
  • Revoke a test tag and confirm it stops verifying.

Known limits#

Warning

Ownership transfer is on the roadmap, not shipped. EdgeNFC today proves the object and holds its record; it does not yet implement a transfer-of-certificate flow that reassigns a record to a new owner on resale. If your programme depends on transferable ownership, treat it as a planned capability and talk to us about timing — do not plan a launch around it.

Warning

Some Android phones need the EdgeNFC app to open the tag. Android 16+ can't NDEF-dispatch NTAG 424 DNA tags — a Google regression — so a tap may do nothing on its own on those devices. The workaround is to scan the tag from inside the EdgeNFC app. In a boutique or an authentication desk this is easily handled with a dedicated device; for consumer-side taps, say so on the packaging rather than letting the customer conclude the tag is dead.

See Brand & Enterprise#

Provenance programmes live on the Brand and Enterprise plans — custom domain, analytics, and the management API that keeps the registry in step with your systems.

Compare plans →