How it works

Proof, not promises.

Official CA checks who controls a contract address. Everything we check, anyone can check again: a DNS record, a public file, a signature, a tweet.

The three proofs

Domain

A TXT record on the domain itself (not a subdomain):

TXT  @  "officialca=<CA>"

Several CAs: separate them with commas. Or a file at https://<domain>/.well-known/officialca.json:

{ "mints": ["<CA>"] }

DNS is read over DNS-over-HTTPS (Cloudflare and Google). The file is fetched over https only, with a timeout and a 64 KB cap, and never from a private address.

Creator wallet

The coin's creator wallet signs this exact message with its wallet's Sign message:

officialca.fun: <CA> is the official token of <domain or @handle>. Nonce <n>.

We verify the ed25519 signature and compare the signer with the creator recorded on-chain in pump.fun's bonding curve (pump.fun's API as a fallback). The signature and message are published on the certificate so anyone can re-verify them.

X account

The project's account posts a tweet containing the full CA and a one-time code (OCA-XXXXXX, valid 24 hours). We read it through the public fxtwitter API and check the author, the text and that it was posted after the code was issued.

The rules

Official takes at least two independent proofs. A domain counts once, whether by DNS or by file.
The creator's signature counts only for an identity another proof has shown: it can't vouch for a domain or handle on its own.
Creator wallet + domain is the strongest pair: the coin's on-chain creator and the project's domain agree.
DNS records, files and tweets are re-checked every few hours. One that disappears is checked again within the hour, then marked lapsed, and the CA stops being official if fewer than two proofs remain.
Impostor means a verified project uses this name or ticker with a different CA. Unverified means nobody has proven anything: not a scam verdict, just no proof.
Anyone can verify their own token. Two verified projects can share a ticker; the checker then lists both with their domains and handles, and you pick the one you follow.

API

Free, no key, rate-limited per visitor. CORS is open for GET.

GET https://officialca.fun/api/check?q=<CA | $TICKER | domain | @handle>
→ { "verdict": "official" | "impostor" | "unverified" | "multiple", "project": {...}, "real": [...], "note": "..." }

GET https://officialca.fun/api/project/<CA>
→ { "project": { "status", "proofs": [...] }, "copycats": [...], "history": [...] }

GET https://officialca.fun/api/radar          the latest copycats
GET https://officialca.fun/api/radar/stream   the same, live (server-sent events)

Badge

An SVG that reads the live status each time it loads (cached for 5 minutes). Green only while the CA is official.

<a href="https://officialca.fun/t/<CA>"><img src="https://officialca.fun/badge/<CA>.svg" alt="Official CA verified" height="28"></a>
<img src="https://officialca.fun/badge/<CA>.svg?style=card" alt="Official CA verified" height="76">

What we store

Projects, their proofs (the public record, file, signature or tweet link), the verify history and the copycats the radar finds. No accounts, no emails, no keys. Visitor IP addresses are used in memory for rate limits and not stored.