Is this document real?
Drop the file in. Standard verification stays on this device: the fingerprint is computed in your browser and matched against the registry.
- Local hashing — document stays on your device
- SHA-256 — tamper-evident fingerprint
- Revocable — issuers can invalidate anytime
Verify by file
No verification yet. Choose a file above or scan a QR-code link.
Optional malware scan
Only if you choose this action, the selected file is uploaded over HTTPS and streamed through ClamAV. RohaVerify does not retain or persist the original file; it retains the SHA-256 fingerprint and scan verdict for reputation checks.
A “no known malware detected” result is not a guarantee that a file is safe.
Verify by link or signature
Register a credential
Compute a fingerprint locally and store only the metadata. We never see the document.
No registration yet. Fill the form above to mint your first credential.
Issuer dashboard
Every credential you have registered, with status, search, and one-click revoke.
Enter an issuer name and click "Load credentials" to see registered documents.
Settings
Configure how this device talks to the registry.
Plan & usage
- Plan…
- Status…
- This month…
Issuer credentials
Issuer access is provisioned during onboarding. Paste a Cognito JWT (when AUTH_MODE=cognito) or your registration API key (when AUTH_MODE=none). It stays in this browser tab and is cleared when you close it.
Required only for API-key accounts. Use the same issuer name you register credentials under.
About
- Version…
- Auth mode…
- Endpoint…
Pricing
Monthly plans by issued-credential volume. New issuer accounts are provisioned during onboarding.
Loading plans…
Need onboarding, custom volume, or SSO? Contact Roha IT Solutions.
API quickstart
Integrate the registry directly from your stack. All endpoints accept JSON.
1 · Authenticate
Send the API key or Cognito JWT provisioned for your issuer in the Authorization header. Browser SAML/OIDC deployments use their signed session cookie instead. Save an issued token in Settings for this tab.
Authorization: Bearer YOUR_TOKEN_OR_API_KEY
Content-Type: application/jsonAPI-key accounts must also send X-Billing-Issuer: Acme University on billing checkout and usage requests.
Your current token (first 12 chars): not set
Base URL: https://api.rohaverify.com
2 · Register one document
Hash the file locally (SHA-256 hex, lowercase) and POST the metadata. The server never sees the file.
curl -X POST "$BASE/api/register" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"signature": "<sha256-hex>",
"issuer": "Acme University",
"documentName": "Cert #2026-001",
"documentType": "certificate",
"issuedAt": "2026-05-12",
"metadata": { "department": "Engineering" }
}'Returns 201 { record, verificationUrl, qrCodeDataUrl }. Counts as 1 against your monthly quota.
3 · Register many (batch)
Send up to 100 documents in one call. Each accepted item counts as 1 against quota; duplicates are free.
curl -X POST "$BASE/api/register/batch" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{ "documents": [
{ "signature": "<sha256-hex-1>", "issuer": "Acme U", "documentName": "a.pdf" },
{ "signature": "<sha256-hex-2>", "issuer": "Acme U", "documentName": "b.pdf" }
]}'Returns { summary: { submitted, registered, duplicates, errored }, results: [...] }.
4 · Verify (public, no auth)
curl "$BASE/api/verify?signature=<sha256-hex>&expectedIssuer=Acme%20University"Pin expectedIssuer to defeat issuer-squat attacks.
5 · Revoke
curl -X POST "$BASE/api/register/<sha256-hex>/revoke" \
-H "Authorization: Bearer $TOKEN"6 · List your documents
curl "$BASE/api/issuer/documents?issuer=Acme%20University&limit=50" \
-H "Authorization: Bearer $TOKEN"7 · Check your plan + usage
curl "$BASE/api/billing/status" \
-H "Authorization: Bearer $TOKEN" \
-H "X-Billing-Issuer: Acme University"
# → { planId, status, monthlyUsage, monthlyQuota, currentMonth, periodEnd }When billing is enabled and quota is reached, registration returns 402 Payment Required. Existing issuers can change plans with POST /api/billing/checkout {"planId":"growth"}.
Hashing tip
# macOS / Linux
shasum -a 256 path/to/document.pdf | awk '{print $1}'
# Python
python3 -c "import hashlib,sys; print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" path/to/document.pdfThe browser performs this hashing locally. The optional POST /api/hash utility uploads the supplied file to the server for hashing, so do not use that endpoint for sensitive documents.
Optional malware scan
curl -X POST "$BASE/api/malware/scan" \
-F "file=@path/to/document.pdf"This explicit opt-in sends file bytes transiently to the private ClamAV service. The response includes the SHA-256, deterministic malware risk score, signature match when flagged, and hash-only reputation metadata. Check an existing fingerprint with GET /api/malware/reputation?signature=<sha256-hex>.