Codes and verification

Your Own Codes

tcc code show

Prints your personal three-word code and how long it is valid for. Add a connection name to get that connection’s code instead — the name is matched loosely, so part of it is enough:

tcc code show mark
tcc code show mark --lang de

--lang overrides the language for that one code. Without it, a connection uses the language the connection was set up in, and your personal code uses the language on your profile.

tcc code list    # every code this device can compute, in one table
tcc code next    # the current window, and when the next rotation happens

Codes are computed on this device from secrets it already holds. tcc code show does not ask a server for the words, which is why it still works with the network down — provided the device has synced at least once.

Checking Three Words

tcc verify amber cargo lantern

This checks the three words against the connections cached on this device and tells you which one matched, or that none did — with the number of connections it was able to check, so you can tell “no” apart from “I only had two to look at”.

It accepts the current code and the previous codes the operator of your server still accepts — one by default — and says which. A code sent shortly before it rotated still matches, marked as a previous code, with the local time it stopped being current — for a message read later, ask for a seal instead. On a connection where every member has their own code, each member is checked and the answer names the member. Your own code never matches: it proves nothing about who sent the words.

The plain form asks nothing of any server. It knows only what this device holds.

Asking the Server As Well

tcc verify amber cargo lantern --public
tcc verify amber cargo lantern --public --country de

--public also asks the public lookup, which can recognise things this device has no way to know about — a beacon, or a code minted by a provider.

The two answers are printed separately and never merged:

This device:
  No match among the 12 connections this device can check. 2 more cannot be checked here — sync, then try again.

The server:
  Match: ...

That separation is deliberate. A local “no match” means this device could not find it, not that the code is fake. Read the two lines as two different questions.

--country is a hint for the public lookup and takes a two-letter country code. It only applies with --public.

A successful public verification is also what lets you start following somebody — see tcc trust follow in the command reference.

Is Someone on Trusted Codes

tcc lookup someone@example.com

Answers whether that address belongs to an account, which is what you want before deciding between an invitation and a guest code.

Sealing Content

A seal proves something came from you.

tcc stamp text "Transfer approved by me"
tcc stamp clipboard

tcc stamp text takes the content as an argument and has the more useful flags:

• --file <path> binds a file to the seal. The file is hashed on this machine and the hash is what is sealed — the file itself is never uploaded.
• --language <code> sets the language of the words.
• --label <text> is the seal’s title. It is encrypted with the text and shown on the phone approval screen.
• --require-approval holds the signature until you approve it on your phone.
• --ref <slug> references another seal, and may be repeated.

The text, the title and the file name are encrypted on this machine. Only someone with the full link can read them. Our server cannot.

There is no email option. Our server never holds a seal’s text, so it cannot send one: copy the link and send it yourself. With --require-approval the text is encrypted to your account before the request leaves this machine, and only your phone opens it. tcc ask does not seal: a sentence that asks for a seal is refused before anything is sent, and names tcc seal text "<text>" and tcc seal clipboard instead.

tcc stamp list           # what you have sealed
tcc stamp export <id>    # a portable proof document for one seal
tcc stamp revoke <id>    # withdraw one

tcc stamp self mints a seal that is about you rather than about a file — “this really is me” — with an optional --description shown on the verification page and a --language for the words.

Seals are part of some plans and not others, and the content seal and the self-seal are separate capabilities. A command you are not entitled to use says so rather than half-working.