A device can be tampered with, that's why a backend verification is always needed. There may be use-cases where such security is not needed, but I think that's

A device can be tampered with, that's why a backend verification is always needed. There may be use-cases where such security is not needed, but I think that's a separate discussion. The developer exchanges the token for the data. In the current implementation the token contains the user data (encrypted). You can reach me directly at robert@passportreader.app to discuss more Edit: links fixed