EdgeNFC
Sign in Start free

Luxury Goods & Collectibles#

The problem#

A watch, a handbag or a graded collectible is worth what its story can prove. Today that story lives in a paper certificate that can be forged, a warranty card that gets lost, and a service booklet that stops at the first resale. The secondary market absorbs the doubt as a discount, and the brand loses contact with the object the moment it leaves the boutique.

How EdgeNFC solves it#

The digital twin: the tag proves the object, the portal holds the record, and the counter shows the interaction history.

  • The tag proves the object. Each tap carries a fresh code signed with a per-tag key diversified from your System Master Key. A photograph of the certificate proves nothing; a tap that verifies proves the physical item is present.
  • The portal holds the record. Because verification happens before anything is shown, an authentic tap can be the gate on the material that matters — certificate of authenticity, service history, warranty registration, concierge contact.
  • The counter shows the history. The monotonic read counter advances on every genuine tap and can never go backwards, so a replayed or copied URL is rejected as non_monotonic.
  • The tag can prove the object without naming it. In encrypted-PICC mode the chip encrypts the UID and counter into one blob before they ever reach the URL, and that blob is different on every read. So a passer-by who reads the link learns nothing that identifies the piece, and two taps of the same item cannot be tied together by anyone who only saw the two URLs — which is what stops a scraped link from becoming a way to catalogue a collection or track an owner. This has been run end to end on a physical NTAG 424 DNA against a live verifier; what does not exist yet is a self-serve switch for it (see Known limits).

How it works here#

Provision at manufacture or at authentication, then every tap over the object's life runs the same verification.

EdgeNFC NTAG 424 DNA edgenfc.com SINGLE-USE CODE A7F3·91C4·5E08 2D9B·04E7·C316 6B1E·FD52·8A47 tap #1,247 tap #1,248 tap #1,249 Genuine Verified at the edge

One tag. A new code every tap — and a fresh proof behind it.

  • 1 Provision, once The app derives a per-tag AES key with AN10922 diversification (your System Master Key + the tag UID), installs it via AuthenticateEV2First + ChangeKey, then writes the SUN URL template mirroring uid, ctr and mac.
  • 2 Tap — a new code, every time The chip's SDM engine mints the URL at read time: the SDMReadCtr counter advances and the MAC changes on every single tap. Nothing is reusable.
  • 3 Verify at the edge Cloudflare re-derives the tag's key and checks the 8-byte AES-CMAC in microseconds, in the same Rust/WASM core hosted and DIY deployments share.
  • 4 Replays rejected A monotonic counter that fails to advance means a captured link is being re-used — it is refused, not redirected. Genuine taps get a 302.
An illustrated end-to-end EdgeNFC lifecycle. A garment hang-tag carrying an NTAG 424 DNA chip hangs from a product on a cord; a smartphone taps it and an NFC ripple spreads out from the contact point. Provisioning happens once, over ISO-DEP: the Android app derives a per-tag key from the System Master Key and the tag UID using AN10922 AES-128 diversification, installs it with AuthenticateEV2First then ChangeKey, and writes the SUN URL template with SDM mirrors for uid, ctr, and mac. On every tap the NTAG 424 SDM engine emits a dynamic URL of the form https://edgenfc.com/?uid=&ctr=&mac= — the phone screen shows the single-use code changing from A7F3·91C4·5E08 to 2D9B·04E7·C316 to 6B1E·FD52·8A47 while the SDMReadCtr tap counter climbs from 1,247 to 1,249. Verification runs at the Cloudflare edge, near the customer, typically in well under a second: the Rust/WASM core re-derives the per-tag key, verifies the 8-byte AES-CMAC, and checks the monotonic counter against D1 to reject replays. The phone then reveals a green Genuine check — a genuine, counter-advancing tap returns a 302 redirect (or a JSON authentic:true payload), while a forged or replayed tap returns the tap page with a not-verified result.

What you need#

PieceWhat to pick
HardwareNTAG 424 DNA tags — no other chip works. A 30 mm epoxy disc or rigid token for hangtags and cases; CR80 cards for the certificate card itself; adhesive wet inlays for embedding into packaging or a lining. Where to buy
PlanBrand for a custom verification domain and geo/scan analytics; Enterprise for the management API, per-tag routing and multi-user access
SoftwareThe provisioning app to encode items; the management API to keep the registry in step with your ERP or authentication workflow

Step by step#

  1. Create a system per line or per collection. Decide up front whether that line needs encrypted-PICC mode, and turn on UID privacy for it if so — the switch is free on every plan and lives beside the Campaign in the dashboard. The UID mode itself is fixed when each tag is encoded and is not switchable afterwards, so the switch marks the intent and hides serial numbers on the verification page; the encoding pass is what puts them beyond a bystander's reach. Tags encoded either way verify through the same endpoint, so the choice affects what a bystander can read, not how your integration is written.
  2. Encode at the point of authentication — at manufacture, at final QC, or when a specialist authenticates a consignment. The tag's UID and key version land in your registry.
  3. Bind the record. Route the item's tag to its own destination (per-tag routing, Enterprise) so the tap opens that item's record. The destination is owner-stored config, never taken from the tag or the URL.
  4. Update the record over the object's life — a service, a re-authentication, a change of destination — through the management API, with no need to touch the hardware again.
  5. Revoke on loss or theft. A revoked tag stops verifying immediately, and every change is written to a non-secret audit trail.

Verify it worked#

  • Tap the item: authentic, and the record opens. Tap it again: authentic, with the counter one higher — that increment is the object's interaction history accruing.
  • Replay a captured tap URL: not authentic, reason: non_monotonic.
  • Re-point a single tag through the management API and confirm the next tap lands on the new record, with nothing re-written on the tag.
  • Revoke a test tag and confirm it stops verifying.

Known limits#

Warning

Ownership transfer is on the roadmap, not shipped. EdgeNFC today proves the object and holds its record; it does not yet implement a transfer-of-certificate flow that reassigns a record to a new owner on resale. If your programme depends on transferable ownership, treat it as a planned capability and talk to us about timing — do not plan a launch around it.

Note

Encrypted-PICC is proven, and the privacy switch is yours — the tag's mode still is not. A physical NTAG 424 DNA has been provisioned in this mode and verified end to end: the tap returned authentic with the UID recovered only by decryption, the counter advanced on the second read, and a replay of the first blob was refused as non_monotonic. Every system now has a UID privacy switch in the dashboard, free on every plan, which stops the verification page from printing serial numbers and marks the system for encrypted-PICC provisioning (how it works). What that switch cannot do is change a tag that is already encoded — the mode is fixed in the chip at encoding time — and the mode has been proven on one tag rather than exercised across a production run. If a line depends on it, plan the provisioning pass around it and talk to us before you commit to volume.

Warning

Some Android phones need the EdgeNFC app to open the tag. Android 16+ can't NDEF-dispatch NTAG 424 DNA tags — a Google regression — so a tap may do nothing on its own on those devices. The workaround is to scan the tag from inside the EdgeNFC app. In a boutique or an authentication desk this is easily handled with a dedicated device; for consumer-side taps, say so on the packaging rather than letting the customer conclude the tag is dead.

See Brand & Enterprise#

Provenance programmes live on the Brand and Enterprise plans — custom domain, analytics, and the management API that keeps the registry in step with your systems.

Compare plans →