Domain Atlas — Suspend & Clawback Demo

A real compromised-key theft, a real suspension, a real blocked sale, and a real recovery.

Click below and this page mints you one collectible, then walks it through a theft the way one actually happens: a key that can sign anything it's asked to, doing exactly that. Everything after is genuine — a real transfer to the thief, a real suspension placed against the fraud report, a real sale attempt that the freeze actually blocks, and then either a real release or a real clawback, your call. Nothing here is staged; every request below is a live call to this domain's own server.

What this looks like for a real business

Swap "collectible" for a company's signing key, a customer's loyalty balance, or a benefits card — anything that keeps its value only as long as it sits with the right key. A suspicious report shouldn't have to choose between doing nothing and undoing it outright: freezing it first buys time to find out which one is true, and the credential itself is what proves whether the freeze is even real.

Step 1 — mint your token

Step 2 — the key behind it gets compromised

A phished password, a copied seed phrase, malware on the device — however it happens, the result is the same: someone else now has a key that can sign anything you could. This page plays both parts, so clicking below signs a real transfer with your own key, sending it to a thief's wallet — dishonest of the thief, but cryptographically a completely ordinary, valid request.

Step 3 — you notice, and report it

You don't have the thief's key, and you can't undo a signature after the fact — but you can still recognize your own token wherever it's landed and ask this domain to freeze it on the spot, pending a decision.

Step 4 — watch the freeze actually work

The thief lines up a buyer and tries to cash out before anyone notices. This is a completely ordinary transfer, the same one that worked fine back in Step 2 — the only thing that changed is the suspension now sitting on this exact credential.

Step 5 — you decide

Both paths below are real. One lifts the freeze and lets the very sale from Step 4 go through exactly as it would have all along. The other reissues the token straight into your own wallet and permanently revokes the stolen one, wherever it currently sits — the thief's laundering hop, if you took it, makes no difference.

Step 6 — verify any credential, independently

Paste a credential's raw JSON below and check it. This runs entirely in your own browser: it fetches this domain's public key and revocation list — the same two public files anyone, including your own systems, could fetch directly — then checks the signature and looks the id up in the revocation list. Try the old, stolen credential after a clawback below and watch it come back revoked.

Nothing on this page is stored in a database anywhere. Suspension and clawback are ordinarily an operator's own admin-gated actions (SPEC.md §5.3, §5.12) — this page reaches a narrow, purpose-built stand-in for that authority that only ever acts on this one toy class, and only when handed the credential's own currently-valid signed body, the same "you can only act on what you can already fully name" rule the login demo's self-serve revoke already uses. Back to the plaza.