A warrant carries its own proof: you verify it locally against the issuer's public key, with no call to any server.
Because a warrant is a signed chain of caveats, a verifier only needs the issuer's public key (published at a well-known JWKS endpoint, cacheable) to confirm the chain is intact and evaluate the caveats against the request. No round-trip, no shared secret, no availability dependency on the issuer.
Offline verification can't know a warrant was revoked a second ago, or track cumulative spend across processes. For those — revocation and stateful spend/rate limits — enforce through the gateway, which also gives you the audit log. Many systems do both: offline for the fast path, gateway for money and revocation.
Free to self-host. 10,000 free decisions on the hosted gateway — no card.
Get an API key Read the docs