Echo Nearby

Before starting

Use a normal Safari tab on the iPhone and Firefox or Chrome on the laptop. Open this preview on both devices while online. Close any older Echo lab tabs, then open Signed request exchange and choose Prepare offline copy on each device. Wait for “Offline copy ready.”

Keep this guide on the other screen or read it before creating a key. Hiding or reloading the lab discards its temporary signing key. Camera, file-picker and app switching can interrupt the page: import first, then create the payer key. Already signed exports remain available. These keys are for this test only.

Record your phone model, iOS/Safari version, laptop browser version and the preview address. Keep clocks set correctly. Give the request 30 minutes so it does not expire during the test.

1. Laptop requests; iPhone responds

On the laptop: create a temporary key. Under Receiver, request 12 whole test credits, set 30 minutes and leave the optional payer restriction empty. Choose Review request, check the amount, receiver and expiry, then Sign this request. Retain the full request ID and receiver address separately before switching apps, and download the .ereq file.

On the iPhone: under Payer, use Scan request QR image to photograph the laptop’s request QR. If the picker offers a photo library, a clear photo of that QR also works. Record which path worked. Confirm the full receiver key against the laptop’s address through your trusted exchange, then enter it in Receiver key confirmed separately. Do not treat the scanned packet as its own identity confirmation.

Now create the iPhone’s temporary key. Choose Check request, then Review payment intent. Confirm 12 test credits, the receiver, request ID and expiry. Choose Sign this payment intent. Expect “Signed and retained” and Pending Sync.

Before switching apps, retain the iPhone’s full payer address, then repeat Review payment intent → Sign this payment intent. Expect “Existing signed response returned unchanged” and one retained response. Copy the payment intent and download its .opi file to Files. Record whether both controls work; if copying fails, the complete packet must remain selectable.

Back on the laptop: paste the returned packet or use Import payment intent file. Keep the original request and separately retained request ID. Enter the iPhone’s confirmed payer key if you retained it, then Compare signed objects. Expect “Both signatures match” and Pending Sync. Keep both exported files.

2. Reverse the devices

Start a fresh request with the iPhone as receiver and the laptop as payer. Use the same sequence. Import the .ereq on the laptop; return the laptop’s QR by photographing it with Scan payment QR image on the iPhone. Compare against the iPhone’s original request, retained ID and confirmed keys.

This checks both QR directions that need the iPhone camera. A file or copied packet is a useful fallback, but a failed camera path must still be reported as failed.

3. Check refusal and offline reload

While a request is still valid, change one character in Previously retained request ID and compare. Expect REQUEST_ID_MISMATCH. Restore the original ID and compare successfully again.

After exporting both objects, disconnect both devices from the internet. On the iPhone, use Airplane Mode and also ensure Wi-Fi is off; turn off the laptop’s network connection. Reload the request lab. It must open from its prepared copy and show no signing key.

On each device that acted as payer, choose Load evidence. Comparing without the saved ID and confirmed receiver key must refuse with CONTEXT_REQUIRED. Enter that independently retained information, plus the confirmed payer key if available, and compare again. Expect a match that still says Pending Sync. If the request has expired, refusal is correct; repeat with a fresh request while online.

Reimport the exported .opi in the Portable intent lab, enter the confirmed recipient and payer keys, then Verify locally. Expect a valid signature and pending status. This checks the original intent flow as well as the signed-request flow.

What to report

Report each separately: request QR capture, response QR capture, copy, .ereq export/import, .opi export/import, wrong-ID refusal, iPhone offline reload and laptop offline reload. Include any exact error and the device/browser versions. “Not tried” is useful; it is not a pass.

No money, account credentials or private signing keys are needed. If a step fails, retain the signed files and report it. Do not delete browser data to force a pass.