Codes and verification

Your Own Codes

tcc code show

Prints your personal three-word code and how long it is valid for. Add a connection name to get that connection’s code instead — the name is matched loosely, so part of it is enough:

tcc code show mark
tcc code show mark --lang de

--lang overrides the language for that one code. Without it, a connection uses the language the connection was set up in, and your personal code uses the language on your profile.

tcc code list    # every code this device can compute, in one table
tcc code next    # the current window, and when the next rotation happens

Codes are computed on this device from secrets it already holds. tcc code show does not ask a server for the words, which is why it still works with the network down — provided the device has synced at least once.

Checking Three Words

tcc verify amber cargo lantern

This checks the three words against the connections cached on this device and tells you which one matched, or that none did — with the number of connections it was able to check, so you can tell “no” apart from “I only had two to look at”.

The plain form asks nothing of any server. It knows only what this device holds.

Asking the Server As Well

tcc verify amber cargo lantern --public
tcc verify amber cargo lantern --public --country de

--public also asks the public lookup, which can recognise things this device has no way to know about — a beacon, or a code minted by a provider.

The two answers are printed separately and never merged:

This device:
  No match among 12 connections this device can check.

The server:
  Match: ...

That separation is deliberate. A local “no match” means this device could not find it, not that the code is fake. Read the two lines as two different questions.

--country is a hint for the public lookup and takes a two-letter country code. It only applies with --public.

A successful public verification is also what lets you start following somebody — see tcc trust follow in the command reference.

Is Someone on Trusted Codes

tcc lookup someone@example.com

Answers whether that address belongs to an account, which is what you want before deciding between an invitation and a guest code.

Sealing Content

A seal proves something came from you.

tcc stamp text "Transfer approved by me"
tcc stamp clipboard

tcc stamp text takes the content as an argument and has the more useful flags:

• --file <path> binds a file to the seal. The file is hashed on this machine and the hash is what is sealed — the file itself is never uploaded.
• --email <address> sends the verification link to somebody.
• --language <code> sets the language of the words.
• --label <text> is the short line shown on the phone approval screen.
• --require-approval holds the signature until you approve it on your phone.
• --ref <slug> references another seal, and may be repeated.

tcc stamp list           # what you have sealed
tcc stamp export <id>    # a portable proof document for one seal
tcc stamp revoke <id>    # withdraw one

tcc stamp self mints a seal that is about you rather than about a file — “this really is me” — with an optional --description shown on the verification page and a --language for the words.

Seals are part of some plans and not others, and the content seal and the self-seal are separate capabilities. A command you are not entitled to use says so rather than half-working.