One-Time Redemption

POST /v1/verify is the consuming verification operation. A valid token is accepted only if the verifier can atomically record its replay identity. A second use receives a replay rejection. POST /v1/check performs validation without recording a spend, so checking does not make a token one-time-used.

V4

The verifier derives a V4 nullifier from the parsed token and its configured verifier scope, then stores a V4 spend key. V4 tokens do not carry an issuer-enforced expiration timestamp, so the persistent replay record does not use a token validity expiry.

The one-time property depends on the storage deployment, not only on token cryptography. Use durable Redis for restart-safe or multi-instance operation; memory is development-only. See replay protection and deployment modes.