Build · Token check
SOURCE · FIXTURE — SAMPLE DATA

Is this Spend Token real?

Paste one in. In about a second you'll know whether Crinkl issued it and whether anyone has touched it since. This checker runs on sample tokens client-side — it is not connected to the live issuer.

Paste the token
JSON

A short code like crkl-spd-… is only a reference number — there's nothing inside it to check. You need the full token. Nothing you paste here is stored or logged.

What we check
1
It looks like a Crinkl token
Waiting
2
Nobody has altered it
Waiting
3
Crinkl really issued it
Waiting
4
Still good today?
Waiting
5
Safe to act on?
Waiting

Where the line sits

A pass tells you
Crinkl issued this token, not someone imitating Crinkl.
Nobody has changed a character of it since.
The merchant, amount, and date are exactly as issued.
Still worth asking
Has it been refunded or revoked since? A signature can't know that — ask the API.
Is the person showing it the owner? Have them sign a challenge.
Run it yourself
npm install @crinkl/verify@0.1.0-alpha.1

// server route — never in the browser
const result = await verify(token, {
  supportedProtocolVersions: ["1.0.0-rc.1"],
  issuerTrust: ({ issuedBy, publicKeyBase64, protocolVersion }) =>
    trustedIssuers.some(i =>
      i.issuedBy === issuedBy &&
      i.publicKeyBase64 === publicKeyBase64 &&
      i.protocolVersion === protocolVersion)
});

Keep your list of trusted issuers on the server and pin Crinkl's key yourself. Never trust a key just because the token carries it — that's how a forged token authorizes itself.