why aren't we verifying based on `app.id` then? why the name?