Signed passes and offline checks

Dumsor doesn't wait for visitors to finish arriving. So that a gate keeps working when the network doesn't, the QR code on every pass, on every plan, carries a code digitally signed with your organisation's own pass key. A kiosk or guard device can check that code on its own: that the pass is genuine and unaltered, and that it admits now, at this gate.

What a signed pass holdsCopy Anchor Link

and the signature over all of it. Changing anything in the code breaks the signature, so a pass with its dates or gates edited is refused. Your organisation isn't written in the code either: a device checks a pass against its own organisation's keys, so a pass from another organisation never passes.

See Multi-day passes and pass rules for days, hours, single use and gates.

Passes that aren't signedCopy Anchor Link

• A pass waiting for its host's approval isn't signed: its QR code holds the pass's link instead, so nobody can be let in offline before someone has said yes. Once the host approves, the pass is signed the next time the visitor opens it.
• A walk-in's visit page (after self check-in) is for the visit already under way, so it isn't signed.

Unsigned codes still work: reception can scan them, and kiosks check them online or against the expected visits they synced.

How devices check a passCopy Anchor Link

Kiosks and guard devices (Kiosk app: iPad and iPhone in P5, Android in P6) keep your organisation's public pass keys and a list of the passes at their site that stopped working early: cancelled, declined or missed visits, and passes replaced when one was sent again. When someone scans a pass, the device checks:

1. the signature, with your organisation's key;
2. that the pass isn't on the list of passes that stopped early;
3. its days, daily hours and gates, against the device's own clock and gate;
4. for a single-use pass, the device's own entries.

A pass that fails is refused with a polite message to see reception, which can let them in anyway if that's right. A pass cancelled after the device lost its connection can't be on its list yet: the device accepts it, and the visit is flagged for reception to review when the device syncs. See Offline mode.

In the Console, Scan a pass reads signed codes and links alike. See Front desk.

Your pass keyCopy Anchor Link

Each organisation has its own pass key, made the first time a pass is signed. Agoo stores only its public half, which devices use to check passes; the private half is never stored anywhere and can't be downloaded.

Replace the keyCopy Anchor Link

Owners and Admins can replace the key in Console → Settings → Security, under the pass key, by selecting Rotate key. Do it if you believe your key has been misused, or as part of your own security routine.

• The old key stops being used at once, and the change is recorded in the audit trail.
• Each pass is signed with the new key the next time it's opened. Passes shown before then carry the old key's signature: devices check those online, or against their synced list of expected visits, until the visitor opens their pass again.
• Nothing needs reprinting or resending.