Authentica: COA Certificates
Building trust you can cryptographically check
Authentica is our Certificate of Authenticity app for Shopify. The brief was proof of authenticity that survives a resale, without asking a merchant or a buyer to touch a crypto wallet. This is the build note behind it.
Features, screens and pricing live on the Miko product page. Installing costs nothing, the free plan covers 50 certificates a month.
Certificate of authenticity, minus the crypto detour
Merchants in jewelry, fine art, collectibles and limited-run goods kept asking for the same thing: a way to prove an item is genuine that a buyer actually trusts, without a hologram sticker that photographs and copies just as easily as the product it is meant to protect.
The tools already doing this leaned on NFTs and blockchain wallets, charged a fee per certificate, and were built around a single niche. None of those three were acceptable for a general-purpose Shopify app: a wallet is a checkout-abandoning step for a buyer who just wants proof, a per-certificate fee punishes merchants for selling more, and jewelry-only presets exclude sneakers, wine, trading cards and every other category where authenticity genuinely matters. Those became the constraints, and the build is the result of taking them seriously.
Six decisions that are not in any feature list
Each of these is a failure we designed out on purpose, most of them specific to making a certificate trustworthy without a blockchain.
Trust without a ledger
Every certificate is signed with an app-wide Ed25519 keypair over a canonical, deterministic representation of its immutable fields, and a SHA-256 fingerprint is taken at issue time. Tampering with any signed field breaks both the fingerprint and the signature, and both are independently checkable from the verification page, with no wallet, gas fee or third-party ledger anywhere in the flow.
The editor cannot lie to the merchant
The certificate layout is built once, in a unit system that renders identically in the drag-and-drop designer and on the public verification page. There is no separate "export renderer" that can silently drift from what the merchant designed, so what is previewed is, byte for byte, what a buyer sees.
One order, several certificates, no double-issue
A single order line can carry a quantity of several units, each needing its own serial number. Allocation runs as one atomic transaction per unit, keyed by a unique constraint on shop, line item and unit index, so a retried webhook can never issue the same certificate twice, and a burst of simultaneous orders can never collide on the same serial.
Provenance that outlives the original buyer
An ownership transfer updates the certificate's current owner while the original issuance record is kept unchanged, so the face of the certificate reflects who owns the item today while the history underneath it stays intact for anyone tracing where it has been.
Revocation has to be automatic, not a checklist item
A certificate's status is derived, not stored as a static flag. Order webhooks for refunds and cancellations flip the underlying state, and the verification page computes Active, Revoked or Expired at render time, so a merchant can never forget to manually revoke a certificate after a refund.
One niche should never mean one layout
Category presets for jewelry, fine art, watches, sneakers, trading cards, wine and more each auto-fill wording, fields and a starter layout suited to that niche, so the app never defaults to a jewelry-shaped certificate for a merchant selling something else entirely.
Verification systems, done without a blockchain
A recurring brief we see is proof: proof an action happened, proof a document is unaltered, proof a party is who they claim to be. That means cryptographic signing over canonical data, a design surface that renders identically everywhere it is shown, idempotent processing of webhooks that can legitimately retry, and derived rather than stored state so nothing needs a human to remember to update it. Those are the parts we had to get right here, and they transfer directly to any client build that needs verifiable proof rather than a database flag.
What the app does, in short
- Auto-issues a serial-numbered, cryptographically signed certificate for every unit on every paid order
- A drag-and-drop designer with a live preview identical to the public certificate
- QR verification, ownership transfer and provenance, and automatic revoke on refund
- Numbered limited editions, back-catalogue issuance, and category presets across a dozen niches
- Printable QR labels, scan-to-verify packing slips, NFC tag writing, and Klaviyo and webhook events
Full detail, every feature and the pricing are on the Authentica product page, and the merchant guide is at miko.co.nz/authentica-docs.
Two screens that carry the trust argument
When software's whole job is proving something is genuine, the interface work is mostly about making that proof legible in one glance.
The designer. Free-positioning canvas, rendered through the same layout engine the verification page uses, so nothing drifts between what is designed and what is shown.
The verification page. Signature and fingerprint were designed in from the first commit, not added after a merchant asked whether the certificate could be faked.
Questions we get about this build
Tripster Developers, a Shopify agency in Auckland, New Zealand. We wrote the certificate engine, the cryptographic signing, the isomorphic designer, and the provenance and revocation logic, and we run the app in production ourselves.
On the product page at miko.co.nz/authentica, which carries every feature, screen and the pricing. This page is the build note that sits behind it.
Yes. Authentica: COA Certificates is live on the Shopify App Store. Installing costs nothing, and the free plan covers 50 certificates a month with the full designer.
Making the certificate trustworthy without a blockchain. Every certificate is signed with an app-wide Ed25519 keypair over a canonical, deterministic representation of its immutable fields, and a SHA-256 fingerprint is taken at issue time, so tampering with any signed field breaks both the fingerprint and the signature and is independently checkable, with no wallet, gas fee or third-party ledger involved.
Yes. Verification systems, cryptographic signing, drag-and-drop designers with a live preview, and metered issuance are common requirements in private app and marketplace-trust work, and they are all in production here. See Shopify app development.
A Certificate of Authenticity app auto-generates a document, and usually a QR-verifiable page, proving a specific item sold on a Shopify store is genuine. Authentica issues one automatically for every paid order, with a serial number and a verification page hosted on the merchant's own store.
Verisart charges a per-transaction fee and is built around blockchain certification for art and collectibles. Authentica charges flat monthly pricing with no fee per certificate, uses cryptographic signing instead of a blockchain, and ships category presets across a dozen niches rather than one.
Yes. Category presets cover fine art, watches, luxury fashion, sneakers, trading cards, memorabilia, wine and spirits, coins and bullion, handmade goods, antiques, rare books and instruments, in addition to jewelry.
Free for 50 certificates a month with the full designer. Starter is $7.99 a month for 500 certificates and removes Authentica branding. Pro is $19.99 a month for 5,000 certificates and adds a white-label verification page.
Yes. Scanning the certificate's QR code opens a public verification page in the buyer's own browser. No app, no account and no wallet are required.
The certificate is revoked automatically. Its status is derived at render time from the underlying order state, so a merchant never has to remember to manually revoke it.
The admin and App Store listing are available in 8 languages: English, German, Spanish, Italian, French, Arabic, Japanese and Chinese. The public verification page itself supports up to 10 languages, including right-to-left Arabic.
Yes, at apps.shopify.com/authentica-coa-certificates, with a free plan.
Yes. Ownership transfer updates the certificate's current owner while keeping a full provenance trail of every previous owner, so the certificate follows the item through resale.
Yes. Back-catalogue issuance runs in the background and certifies every past paid order in one go, so a merchant does not have to certify only new sales going forward.
Built by Tripster Developers
Authentica: COA Certificates is built and maintained by Tripster Developers, a certified Shopify Plus Partner working on Shopify since 2016, from Auckland, New Zealand. Authentica is the newest app in the Miko suite, built for merchants whose product's value depends on being provably real.
We build the same way for clients: custom Shopify themes, Shopify Plus builds, ERP and middleware integrations, and private apps for merchants who need something the App Store does not sell.
Need something verified, signed, or proven genuine?
Tell us what needs proof, and we will tell you how we would build it.
Start a conversation