endstate.verify

verify(input: TapInput, options?: VerifyOptions): Promise<TapSession>

Input

string

required

The chip that was tapped, ^[0-9A-Fa-f]{10}$. Normalized to uppercase before sending.

string

required

The single-use tap credential, ^[0-9A-Fa-f]{32}$. Each one works exactly once - never cache or reuse it.

string

Tap verification code, ^[0-9A-F]{16}$. Present whenever the tag carries one. Forward it when you have it.

A TapInput also carries source, url and raw when it came from a tap source. Those are local metadata and are never sent to the API.

const session = await endstate.verify({ chip_id: chipId, e, c });

A tap read from a redirect destination carries no c - the redirect forwards endstate_chip_id and endstate_e only - so omit it there.