Academic verification

Every issued document (report card, transcript, certificate, attendance letter) is signed with HMAC-SHA256 using a server-side secret and gets a QR + short verification code.

Verify a document

1. Scan the QR or visit verify.eduwallet.ug
2. Enter the verification code
3. See the signed payload with authenticity status

Rate limits

The public API is rate-limited to 30 requests/minute per IP. All attempts are audit-logged in verification_attempts.

Revocation

Schools can revoke a document from School → Verification Settings → Issued Codes. Revoked codes return HTTP 410.