Skip to main content
For verifiers

Verify a Postboard Track Record

Someone gave you a Postboard verification link. This page is for you — lenders, landlords, accountants, partner platforms — and explains how to check that the numbers on a Track Record snapshot are real, in 30 seconds or via a 2-line API call.

Read the API guideBecome a verifier

Three ways to verify

Pick the one that matches your workflow. All three return the same data; only the integration shape differs.

1. Click the link

The fastest path. Open the URL the applicant gave you. You'll see a verification page with the snapshot date, total verified income, project count, and a QR code that points to this same data. No login required.

Best for: one-off underwriting reviews, individual screenings.

2. API call

Programmatic verification. One GET request returns structured JSON with HMAC-SHA256 signature for tamper detection. See the code samples below.

Best for: bulk verification, integrating into your own underwriting pipeline.

3. PDF letter

The applicant can also send you a downloadable PDF income verification letter. The letter includes the verification URL, hash, and QR for your records.

Best for: traditional underwriting workflows that require a document.

API integration guide

Two endpoints, both RESTful JSON, both rate-limited per partner. Snapshots are valid for 90 days from issue date.

GET /api/verifier/track-record/[token]

Returns the full Track Record snapshot the applicant authorized.

curl https://www.postboard.io/api/verifier/track-record/$TOKEN

{
  "schema_version": "1.0",
  "handle": "alice-photographer",
  "displayName": "Alice Garcia",
  "memberSince": "2024-03-15T...",
  "memberSinceYear": 2024,
  "postboardVerified": true,
  "verifiedEarnings": { "cents": 8420000, "display": "$84,200" },
  "projects": { "completed": 47, "active": 3 },
  "clients": { "unique": 32, "repeat": 11, "repeatRate": 0.34 },
  "rating": { "average": 4.9, "reviewCount": 28 },
  "reliability": { "onTimeRate": 0.96 },
  "lastActivityAt": "2026-04-22T...",
  "issuedAt": "2026-04-30T...",
  "expiresAt": "2026-07-29T...",
  "verificationHash": "a1b2c3...",
  "signature": "<HMAC-SHA256 over canonical JSON>"
}

Token-scoped. No auth header required for read; the URL itself is the bearer. Token expires 90 days after issue. The applicant can revoke from their dashboard.

POST /api/verifier/verify

Independently verify the HMAC signature on a snapshot. Useful when you've stored the JSON locally and want to confirm it hasn't been tampered with.

curl -X POST https://www.postboard.io/api/verifier/verify \
  -H "Content-Type: application/json" \
  -d '{
    "snapshot": { ... },
    "signature": "a1b2c3..."
  }'

{ "valid": true, "kid": "tr-2026-q2", "issuedAt": "..." }

Validation uses RFC 8785–style JSON canonicalization pluscrypto.timingSafeEqual.

What Postboard verifies

  • Total verified earnings
    Sum of paid invoices in the trailing 12 months. Anchored to Stripe webhooks; cannot be self-attested.
  • Completed projects
    Projects marked complete + any final-milestone-paid status. Backed by signed lifecycle events.
  • Unique + repeat clients
    Distinct client emails, with repeat-rate as a stability signal.
  • Average review rating
    Auto-collected post-completion. Single review per completed transaction. Fraud-checked.
  • On-time payment rate
    Of paid invoices, the share paid by their due date.
  • Member-since date
    When the provider opened their Postboard account. The reputation moat compounds with tenure.
  • Income variance
    Month-over-month coefficient of variation. Steady earners score lower variance.
  • Longest revenue gap
    Maximum days between paid invoices in the window.

Privacy + security

  • Provider-controlled. Snapshots are issued by the provider on demand. They choose the verifier and the expiry. Postboard cannot disclose Track Record data without provider consent.
  • No SSN, no bank routing.Track Record verification doesn't expose tax IDs, account numbers, or any sensitive identifiers. Just the income picture.
  • Signed + timestamped.Every snapshot is HMAC-SHA256 signed and time-bounded. A 91-day-old snapshot is invalid regardless of who's holding it.
  • Audit trail. When you fetch a snapshot, the provider sees the access in their verifier-grants list.
First-cohort verifiers

Become an early verification partner

We're working with a small number of first-cohort lenders, landlords, and platforms to make Postboard Track Records a recognized form of income verification for independent workers. Early partners get integration support, joint comms, and a featured listing on this page.

Reach out — partners@postboard.io

Institutions accepting Postboard verification

The list grows as the first-cohort partners come online. If your institution accepts Postboard Track Records, email us and we'll add you here.

We're building this list now.

Be the first institution to accept Postboard verification. Reach out.

Are you the independent worker who got referred here?

Learn about Postboard-Verified →Start your own Track Record →