Binding professional licences
to keys, in the open.
Impersonation works because a licence number is only text. Anyone can type one. Revow is a permanent open lab for the formats, proofs and incentives that make a credential claim attributable, dated, checkable and revocable, starting with no cooperation from anyone and growing stronger as issuing authorities take part.
Every register surveyed, by what it publishes. A public page per licence is close to universal. A bulk export exists in under a third. A file signed by the authority exists nowhere, in any jurisdiction, for any trade. That last bar is the whole of this lab’s work, and the indexcarries the evidence row by row.
The problem this lab works on
A fraudster registers a domain one character from a real agency, has a model clone its website, opens a wallet an hour old, and quotes the real licence number of the person being impersonated. At the level of appearance the fake is perfect. The client is about to send the price of a house.
Every defence that relies on reading a licence number fails here, because the number is public and copying it is free. The question is not how to verify the number. It is how to make the claim around it cost something, leave a permanent trace, and decay on its own.
A licence register is the obvious answer and it is mostly unavailable. Across the registers surveyed so far, a public page per licence is common, a bulk machine-readable export is rare, and a signed file does not exist anywhere. There is no API to call, and waiting for one is not a plan.
So the protocol is built to work at zero cooperation, and to get stronger one layer at a time. An authority that joins later changes nothing about the documents already published. It only raises the level they reach.
Four layers, none of them required
| Level | What it is | What it costs to forge | Needs |
|---|---|---|---|
| L0 | The professional signs a claim: trade, jurisdiction, licence number, legal name, validity window. | Nothing. But the lie is permanent, dated and attributable to a key. | Nobody |
| L1 | The same key is published in DNS on the domain the business already uses, and the claim names that domain. | Control of the real domain, which is exactly what a lookalike domain does not have. | The business |
| L2 | Independent checkers compare the claim against the public register page and sign what they saw. | Getting the register itself to list you. | A public register page |
| L3 | The issuing authority publishes a file listing its licences, on its own domain, signed. | The authority key. | One file |
Full detail, including what each level does not prove, is on the levels page.
The ask to an authority is one file
The reason credential checking has not happened is not that authorities refuse. It is that the usual ask is an API, a procurement cycle and a budget, and the answer is no for years.
So the ask here is deliberately the smallest thing that works. Export the licence list you already hold to a CSV. Put it at a stable address on your own domain. Say how often it changes. That is the whole of level 3 tier A, and it is an afternoon of work for someone who already runs the register.
Signing that file is one more step, and it is the step that makes the file impossible to forge. It is a key and a DNS record, no integration and no dependency on Revow or anyone else.
licence,status,trade,legal_name,updated
4102938,active,real-estate-agent,Northpier Property Pty Ltd,2026-11-08
4102955,suspended,real-estate-agent,Calloway Group Pty Ltd,2026-11-08
4103011,active,auctioneer,Brightwater Holdings Pty Ltd,2026-11-08
4103047,active,resident-letting-agent,Seabright Letting Pty Ltd,2026-11-08That is the entire tier A requirement. No schema negotiation, no endpoint, no uptime commitment, no contract with anybody.
What Revow is not
Not a register of professionals
No list of people is held or published here. Claims live wherever their subject puts them and are identified by their digest, not by an entry in a database.
Not a badge
Nothing here outputs the word verified. A consumer is given the level reached and the age of the evidence, and makes its own decision.
Not a trust list
Revow does not decide whose attestations count. If it did, it would become the authority it is trying to route around.
Not a product
There is nothing to buy and no account to hold. The specifications are CC0 and the reference code is MIT.
Who is doing the work
Revow is funded and tested by Bulbea (opens another site), an onchain payment router that carries exactly the risk this protocol exists to reduce: a client about to send a large payment to an address they cannot check. Bulbea implements the specifications and reports what breaks.
Field data comes from The Payout Index (opens another site), which surveys practitioners across trades and jurisdictions about how they are paid and how they are checked, and publishes its questionnaire and its sample sizes.
Neither of them decides what the protocol says. A specification that only one implementer can use has failed, and the open problems page exists so that disagreement has somewhere to go.
The lab is open to professionals, authorities, implementers and researchers, each with a different first step.