Preverification API

I'm not sure how this is supposed to work exactly but don't we need to set our private key? This looks like anyone could create one of these tokens.