How do you verify a location proof without calling the vendor?

Last reviewed 20 October 2026

You check the proof’s signatures yourself against keys it carries, and its hardware attestation against Apple’s and Google’s published roots, using an open-source verifier such as octet-verify, so no request goes to the vendor and the check does not depend on trusting it.

Why it matters

If checking a result means calling the vendor’s API, the vendor is the one being trusted, and the record shows only what the vendor said. A proof that verifies offline can be checked by an auditor, a regulator or a counterparty years later, with no account and no network.

The steps with octet-verify

octet-verify is a small open-source Rust command-line tool. The default build pulls no networking libraries, so the code you are trusting stays small.

git clone https://github.com/octetproof/octet-verify
cd octet-verify
cargo build --release --features appattest
./target/release/octet-verify proof.bin

The output lists every check, each marked PASS, FAIL or NOT-CHECKED, and an overall VALID, INCONCLUSIVE or INVALID. A check that could not run stays visible rather than silently passing.

What it checks

• Freshness. The proof is recent enough for your policy.
• Signatures and chain. Every stage is signed and linked, so nothing was added, removed or altered.
• Binding. The verdict, region and replay token are bound to the signed data.
• The region claim. For example, that the proof claims country:US. You can require a region with --expect-region.
• Hardware attestation. Built with --features appattest, it validates iOS App Attest against Apple’s root and Android key attestation against Google’s root, offline.

In automation

Exit code 0 means authentic, 1 invalid, 2 a usage or input error, and 3 inconclusive. Exit 0 alone does not mean the key was hardware-attested. To require that, build with --features appattest and pass --require-attestation, so a proof without attestation exits 1. Add --json for one machine-readable result per proof. The verifier quickstart has the full reference.