Verify it yourself

1. Get the verifier and the key:

   curl -sO https://cainstudio.online/broker-keystone/verifier.py
   curl -s https://cainstudio.online/broker-keystone/.well-known/jwks.json > jwks.json
   pip install cryptography

2. Mint a credential (demo), then in Python:

   import json, verifier
   jwks, seen = json.load(open("jwks.json")), set()
   claims = verifier.verify(TOKEN, jwks, aud="https://cainstudio.online/api/v1/broker-keystone/demo-api",
                            method="GET", path="/orders/A-1042", seen=seen)
   verifier.verify(TOKEN, jwks, ...same..., seen=seen)        # raises Refused: replayed

3. Try: another path, another method, a changed body, an expired token, a token re-signed with your own key, a child from /attenuate after the parent was used. Every one must raise.
4. seen must be shared by every instance of your service (a set works for one process only).

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.