# Verified clients

Source: https://tehoclient.dev/modules/verify
SDK: 1.0.0

The handshake only tells you a client *claims* to be Teho. Verified clients give you proof, signed by the Teho backend, that you can check offline.

| Capability | Proves |
|---|---|
| `assert:1` · identity | This connection belongs to the Minecraft account it says, on a real Teho Client, right now. |
| `attest:1` · integrity | All of the above, and the client is an unmodified, attested Teho build. |

Use identity for anything account-bound, and integrity for ranked queues and "verified only" lobbies.

## Request a proof

```java
teho.verify().integrity().thenAccept(proof -> {
    if (proof.valid()) {
        rankedQueue.admit(teho.uniqueId(), proof.build());
    } else {
        player.sendMessage("Ranked needs a verified Teho build: " + proof.error());
    }
});
```

`identity()` works the same way. `verifiedClient()` tells you whether this player already passed an integrity check in this session. Proofs are checked against the client's real capabilities, so a client that cannot provide one gets `valid() == false` with an error saying so.

| `Proof` | Notes |
|---|---|
| `valid()` | Signature, nonce, server and expiry all check out. |
| `kind()` | `IDENTITY` or `INTEGRITY`. |
| `player()`, `name()` | The account the backend signed for. |
| `build()` | The client build. |
| `issuedAt()`, `expiresAt()` | Proofs are valid for 5 minutes. |
| `error()` | Why it failed, when it did. |
| `token()` | The raw signed token, if you want to forward it to your own services. |

## How it works

1. The SDK sends a fresh random nonce.
2. The client asks the Teho backend to sign `{uuid, server host, nonce, issued, expires, client build}`. For integrity, the backend also checks the build attestation.
3. The backend signs it with Ed25519. The client passes the token back to you.
4. The SDK verifies it offline with the public keys from `GET /v1/api/keys`, and falls back to `POST /v1/api/verify` if it cannot.

The token is bound to your server's host and your nonce, so it cannot be replayed on another server or later.

## Verified servers

The other direction: registered servers get a certificate, fetched with their server key or set in config, and sent in `Welcome`. Players then see a verified tick on your toasts and screens. Leave `backend.url` empty to use Teho's production backend, and keep your `tsk_` key out of version control. `teho.verifiedServer()` tells you whether it was accepted.

```yaml
backend:
  url: ""
  key: "tsk_…"

verified:
  certificate: ""
```

## No code

```text
/tehoapi verify Notch
/tehoapi integrity Notch
```