The heart of it
Signing and single use
Every challenge comes with a token carrying the expected answer, the moment it was issued and a signature computed with a key specific to your shop. The server therefore keeps nothing between display and submission: verification is done by recomputing the signature.
Three checks run in sequence on submission:
- Signature — a tampered token is rejected without even being read.
- Expiry — past ten minutes, the challenge is no longer accepted.
- Single use — the fingerprint of a consumed token is stored until it expires, which rules out replaying a correct answer.
Only the token's fingerprint is kept, never the token itself. Renewing the signing key from the back office invalidates every challenge in circulation instantly.