FAQ / Articles
Stopping call sign impersonation in your app
If your app shows call signs, whether on a logbook, a net roster, a spotting cluster or a forum, someone can sign up as somebody else. Here's how to know a user really holds the call sign they claim.
The usual approaches, and their gaps
- Take their word for it. Ask for a call sign at sign-up and display it. Anyone can claim any call sign, including a well-known one, and post as them.
- Check it against the FCC database. This confirms the call sign exists and is current. It doesn't confirm the user holds it: the lookup works just as well for an impersonator.
- Email a code to the address on file. The FCC records an email address for many licensees, but it's often missing or out of date, and an inbox is easier to take over than a mailbox.
- Mail them a code yourself. This works, but you build and run it: buying postage, printing cards, handling codes, re-checking licences when they lapse or call signs are reassigned.
Let someone else do the postcard
Verified Ham mails each operator a one-time code at the address on their licence and checks it comes back,
then re-checks every verified call sign against new licence data. Your app signs users in with standard
OpenID Connect and receives their call sign with "callsign_verified": true. You never handle
postage, codes or licence data.
Adding it
- Register your app to get a client ID and secret. It's free.
- Follow the guide for your platform: Discourse, WordPress, Keycloak, Next.js, Node.js, Python or plain PHP.
- Ask for the
openid callsignscopes, and key your users bysub. - Add the "Sign in with Verified Ham" button to your sign-in page.
Only verified operators can sign in to your app once you've verified your own call sign, so every call sign you receive is one somebody proved. See it working first in the playground.
What it costs your users
A one-time $3.00 for the postcard, which covers printing and postage. After that, their verified call sign works in every app that supports Verified Ham.