The only open-source toolkit built on NIST-approved cryptography that verifies every AI-agent checkout and assembles the chargeback evidence pack — automatically.
No card required · Runs 100% locally · Apache 2.0 open source
What ProveTheBuy does
Four tools built for the age of AI-agent commerce — from the first signature check to the final dispute submission.
ECDSA-P-256 and Ed25519 signatures verified against live card-network directories. Replay attacks, spoofed keys, and out-of-mandate orders are all caught.
Write rules in YAML and diff them against 30 days of real traffic before going live. Zero risk, full preview.
Every verification is SHA-256 chained with the public-key snapshot locked at order time — an unbroken chain of custody no issuer can dismiss.
Per-agent dispute rates feed the reputation engine. Automatic step-up above your threshold — shared across Scale merchants from day one.
How it works
Drop the verifier into your existing checkout. It runs silently — never blocking payment, never slowing down checkout.
Add connectCloud(ledger, { apiKey }) next to your checkout. Every agent order is captured automatically.
Each agent order gets a cryptographic signature, a verdict, and a timestamped evidence pack — stored for 13 months.
When Stripe sends a dispute, ProveTheBuy scores it, writes the response, and submits evidence before the deadline.
What each plan does for your disputes
| Before a dispute | When a dispute arrives | After | |
|---|---|---|---|
Free $0 |
Traffic report: agents buying, how many reached checkout, how many were signed. | Flags the order as agent-placed and shows whether a record exists. Does not build the pack. | Records expire after 30 days. Verification keeps running. |
Indie $9 |
13-month records with a locked key archive. Shopper confirmation page (50/mo) so step-up approvals become your strongest evidence. | Fight-or-refund score. Human-readable authorisation PDF. One-click Stripe submission. Deadline alerts at 7, 3 and 1 days. | Wins log. A single dispute won pays for the plan for years. |
Pro $49 |
Enforce mode with dry-run against 30 days. Risky orders get the confirmation step before payment — the cheapest dispute is the one that never happens. | Fully automatic. Stripe dispute arrives → pack built → scored → submitted (or flagged "refund instead") before anyone looks at it. | Win-rate report by reason code and by agent. Agents above your dispute-rate threshold get step-up automatically. |
Scale $199 |
Cross-merchant shared reputation: an agent key flagged anywhere is stepped up on its very first order with you. | Earlier undisputed orders from the same shopper and agent key are attached automatically (Visa CE 3.0). | Audit report (CSV + signed JSON), external ledger anchoring, pre-arb second-round pack built automatically. |
Cryptographic foundations
Covers ECDSA/EdDSA (Ed25519), ECDSA-P-256, and RSA-PSS — the three signature families accepted by Visa TAP, Mastercard Agent Pay, and Web Bot Auth. FIPS 186-5 (2023) was the first federal update to allow Ed25519A.
SHA-256 is used for nonce hashing, JWK public-key snapshots, order disclosure digests, and every link in the tamper-evident evidence ledger chain. SHA-384 and SHA-512 are available for JWS/JWT disclosure.
P-256 (secp256r1) is the approved NIST curve used by ECDSA agent keys, entities 128-bit equivalent security strength — the threshold for signatures through the 2030s per SP 800-131A.
The IETF standard that defines how to sign HTTP requests end-to-end. RFC 8421 verifies the signature base string covering method, authority, path, headers, and the body — which means every covered component tamper-evident.
Find your fit
Every plan shares the same verifier and evidence ledger. The difference is what happens when a dispute arrives — and how much of that you want to handle yourself.
In five minutes you'll see exactly which agents hit your checkout and whether any of those orders were signed. Most merchants are surprised by what shows up. When the first dispute arrives, you'll know immediately if it was agent-placed — and you'll know exactly what Indie would have done for you.
You don't have a team. When a dispute arrives it lands in your inbox, you deal with it yourself, and you're never quite sure if it's worth fighting. Indie solves exactly this: every dispute gets a clear fight-or-refund verdict, a one-page PDF an analyst can actually read, and one-click Stripe submission. A single dispute won pays for the plan for years.
Pro handles disputes before you see them. The pack is built, scored, and either filed or flagged "refund instead" automatically — you get one notification per outcome. Enforce mode means the riskiest orders never complete without a shopper confirmation, so many disputes never arrive at all. The monthly win-rate report is the number you share with your team.
The evidence at Scale isn't just stronger — it's a different category. An agent flagged at any other Scale store is stepped up on its very first order with you. Earlier undisputed orders are attached to every chargeback pack. Your ledger is anchored externally every day, and when an issuer rejects your first dispute response, ProveTheBuy builds the second-round pack automatically. Most merchants never get a second shot at pre-arb. You will.
USD · Indie, Pro and Scale billed monthly by Dodo Payments · Cancel any time · Billing never affects checkout — verification always keeps running even if a payment fails