Dealer tools

Selling a verified item? Every Metal Stack record comes with free plumbing you can wire into a listing, a shop page or your own stock system — a live badge, a proof link that re-runs the cryptography in the buyer's browser, and a JSON API. Nothing needs an account or a key.

1 · The proof link

The simplest tool is the record URL itself with ?verify=1 — it opens the record and re-computes the SHA-256 hash live in front of the buyer, character by character, against the published preimage. For a sceptical buyer it closes the conversation.

https://metalstack.app/1000000?verify=1

2 · The badge

A live SVG badge that always reflects the record’s CURRENT status — if a record were ever revoked, every badge pointing at it changes on its own. Embed it with plain HTML:

<a href="https://metalstack.app/1000000">
  <img src="https://metalstack.app/badge/1000000.svg"
       alt="Metal Stack verified #1000000" width="300" height="76">
</a>

Each record’s own badge page (metalstack.app/badge/{id}) shows a preview and a copy-paste snippet.

3 · The status API

Machine-readable status for any record — CORS-open, no auth, cache-friendly. Non-existent, private or specimen records return 404 with status "not_found", so a fabricated id gains nothing:

GET https://metalstack.app/api/status/1000000

{ "id": 1000000, "verified": true, "status": "verified",
  "title": "…", "metal": "…", "record_hash": "…", "url": "…" }

4 · The register, in bulk

The whole public register is published for independent verification — the ordered hash list at /register.json (recompute the root yourself), each record’s exact hash preimage at /{id}/record.json, and the daily OpenTimestamps proof at /anchor/latest.ots. New verifications also publish as RSS:

https://metalstack.app/register.json     — ordered hashes + root
https://metalstack.app/1000000/record.json — one record's preimage
https://metalstack.app/anchor/latest.ots — daily Bitcoin anchor
https://metalstack.app/register.rss      — newly verified items

Fair-use note: responses are edge-cached and POST/API traffic is rate-limited per IP. If you want to poll the register at volume or integrate deeper, email hello@metalstack.co.uk — we’re happy to help.