No raw media URLs
Protected files stay private. Clients receive short-lived stream URLs only after entitlement checks.
Security architecture
Physical tags create access. They do not carry the music.
MusicTap keeps durable media and entitlement decisions server-side. The tag contains an opaque unlock URL; the backend controls the active lease, metadata access, and signed stream URL issuance.
Verified tags only
Generated tags start inactive. TagWriter must write and read them back before listener scans are enabled.
Last scan wins
A new scan of the same physical tag revokes the prior session and creates a fresh lease for the current holder.
Batch control
Each run is tracked with status, physical serial, write state, verification state, and resource mapping.