Not a password. Not a link. A signature.

Most “scan this” experiences are just a link. A QR code or a plain NFC tag can be photographed, forwarded, and reused by anyone who gets a copy, because the code itself carries no proof of the physical tap that revealed it. A Watermelon Auth card is a chip that signs its own tap: every read is cryptographically bound to that card’s identity and a counter that only moves forward, so a copied link is worthless the moment the real card is tapped again. What a tap unlocks is scoped, time-bound, and revocable — not a static secret on a piece of plastic.

A copied link is just a link. A copied card doesn’t work.

What a tap proves

Every card signs its own tap

Each card is an NXP NTAG 424 DNA chip: NFC with onboard AES authentication and secure dynamic messaging. The tag embeds its own UID and a forward-only read counter into the URL it serves, and the signature is checked before anything is granted. Replay a tap and it is refused. Copy the URL and it stops working as soon as the real chip is tapped again.

proves : the chip is in your hand

Three tiers, never blurred

An unverifiable claim should never borrow cryptography’s credibility. Every claim a Watermelon Auth record makes falls into exactly one of three tiers, and the record page says which.

Proven by cryptography

The tag is authentic

Established by AES-CMAC and EV2 mutual authentication. This is math, and anyone can check it independently. Tier 1 is shown with a checkmark and its visible evidence.

Attested by the server

The record is unmodified

A row is unmodified since it was written, and carries a timestamp and the principal that recorded it. This rests on database integrity and the discipline of never issuing an update to a provenance row.

Asserted by a person

The story itself

An origin, a find date, a maker’s name. True or false, the system cannot verify it — it can only record who said it. Tier 3 is shown as attributed and unbadged, and never shares iconography with tier 1.

How it works

Tap the cardwith your phone. No app to install, no password to hand out or forget.
The verifier checks the chipits signature and its read counter. A replay is refused, not answered.
You get an identity, a record, or one thing briefly scoped to what that card is permitted to show, for as long as it is relevant.
Every use is logged to the cardwhich tap opened what, and who recorded it — tenant staff or the platform.

What it’s for

Staff and contractor badges

Know who’s actually at the door

A badge that doesn’t just display a name — it proves the person standing there is holding the one physical card issued to them, verified the instant they tap. A technician taps and the customer’s phone shows a verified, tenant-branded identity page. Lost the badge? Revoke it in seconds. No shared codes, no photographed ID that works forever.

Specimen and object provenance

Provenance you can check, not just read

Locality and chain of custody are the market’s real value drivers. A tag on a piece carries proven authenticity of the tag itself, plus a record of finds, transfers, and attributed sourcing — each claim labelled for what it is. You will never see an unverifiable story dressed up with a checkmark it didn’t earn, which is why the checkmarks that do appear mean something.

Tap-gated access and field operations

Swap the shared password for a tap

The same primitive, pointed at something other than an identity or a record — an ongoing view for one subject, or a one-shot action where the tap itself is the record.

Ops access without another password. Replace a shared basic-auth password on an internal dashboard with a tap; every access is logged to the card that opened it.
Live tracking for one person or thing. Hand a card to a recipient; a tap opens that one subject’s status, scoped to the event window and to one viewer at a time.
Proof of presence in the field. A fixed tag at a checkpoint or job site logs a timestamped visit on each tap — a route, an audit trail, or a score that is a provable sequence of real taps at real places.
Feedback tied to a real interaction. A tap after a visit opens a survey scoped to that moment, so a response can’t be duplicated or forwarded to someone who was never there.
Device enrollment without a pairing code. A tap registers a device to an account or fleet, succeeding exactly once per tap.

Opening a page with a tap

Tap-gated web access

One card, one page, one tap

A card can hold the key to a web page instead of an identity: tap it and the page opens, with nothing typed and no password to hand out. The chip signs the tap, the verifier checks that signature and the read counter, and the answer is a short-lived grant — single-use, minutes long — that the page redeems for a session.

No shared secret to rotate. There is no password on the page to leak, forget, or hand to a contractor. Access is a physical card, and revoking one is a record, not a site-wide password change.
A tap cannot be forwarded. The grant is bound to the chip’s counter and burns on first use: a photographed link, a copied URL, or a replayed tap is refused, not answered.
The session is bounded and attributable. The grant lives minutes, the session it buys lives hours, and each tap that opens the page is logged to the card that opened it.
One viewer at a time. Where a page is meant for one person at a moment, a new tap supersedes the previous session on its next request.

Live today: 04202030.com/status/ opens from a card tap, and a tap that fails the check gets an error page — never the page itself.

When the tag has to resist tampering

A tag can only prove it is genuine and registered — not that it is still physically attached to the object it was mounted on, since a tag can be moved to a different item. For use cases that need more, the tamper-resistant version uses TagTamper hardware (NT4H2421Tx), whose tamper-loop status mirrors into the same SDM-readable message this system already parses, combined with tag-in-place photography and a documented mounting method.

What that does and doesn’t cover

Tamper protection holds only when the physical mounting actually routes the tamper loop through something that is destroyed on removal. It is not a universal guarantee, and we don’t describe it as one.

A real example

Richard’s Minerals

Every specimen carries its own history, kept attached to the stone and sealed by a card at each claim. Tap a card on their verifier to see a tenant of this system in the wild.

rm.melon.tips 🍉

The system behind it

Watermelon Auth is a multi-tenant NTAG 424 DNA credential and provenance system, operated by bbbuds.com as both a self-service platform and a managed provisioning service. It grew out of a single-tenant build for Maine Freedom Academy and was generalized so any business can issue tap-verified identities and object records without touching another tenant’s data. Each organization gets its own hostname, its own keys, and its own look.

Every server-side action carries whether the tenant’s own staff did it or bbbuds staff did it on their behalf, so a record never silently misattributes who actually produced it. This page is the system’s own; the example above is one tenant of many.