Prove what the agent was allowed to buy.
An open-source verifier for orders placed by AI agents. It checks the agent's signature and the shopper's signed limits at your checkout, and keeps a record you can still verify when the chargeback lands months later.
import { ProveTheBuy, KeyDirectory, KNOWN_DIRECTORIES } from "@provethebuy/verify" import { createMiddleware } from "@provethebuy/verify/express" const ptb = new ProveTheBuy({ merchantId: "acct_your_shop", keys: new KeyDirectory({ sources: [{ name: "visa", url: KNOWN_DIRECTORIES.visa }], }), policy: { mode: "shadow" }, // record only, never block }) app.post("/checkout", agents.capture(), agents.verify(), handler) // req.provethebuy.decision: allow | step_up | block
✓ signature Ed25519 against the Visa key directory ✓ nonce first seen, not a replay ✓ order cart adds up, addressed to acct_your_shop ✓ mandate $184.00 inside the shopper's $250.00 limit → filed rec_o4Vx8KrZkA0OGlwm, hash-chained
$ npx @provethebuy/cli traffic-check access.log Agent traffic check access.log Requests in log 1,036 From AI agents 216 On checkout paths 51 (/checkout, /cart, /api/checkout, /orders) Signed (verifiable) 14 (7 declared they were paying) Agent Operator Kind Requests Checkout ChatGPT-User OpenAI user-agent 46 27 GPTBot OpenAI crawler 38 0 ClaudeBot Anthropic crawler 27 0 PerplexityBot Perplexity crawler 24 0 Claude-User Anthropic user-agent 19 8 Signed agent unknown user-agent 14 7 Perplexity-User Perplexity user-agent 11 9 User-Agent names can be faked; only signed requests can be verified. $
Start with one command. No account.
Point the CLI at an access log and see how many AI agents already reach your store, how many hit checkout, and how many sign their requests.
Your logs stay on your machine
The log is read locally and never uploaded. Works with nginx, Apache and most combined log formats.
Point it at your checkout
Pass --checkout /buy,/cart if your paths are different, or --json to pipe it somewhere.
Share the result
It prints a one-line summary you can post, so other developers can compare their numbers.
Three checks at order time. One record for dispute time.
It runs inside your own server, never sees a card number, and starts in shadow mode, so it records what it would decide without blocking a sale.
Verify the agent
Checks the HTTP message signature (RFC 9421, Web Bot Auth) against the card network's key directory, and rejects replays, expired signatures and edited requests.
keyid, nonce, created, expiresBind the order
Checks the shopper's signed mandate (Verifiable Intent, AP2) and payment token limits, and confirms this exact cart, amount and merchant are inside them.
RFC 8785 + SHA-256 order hashKeep the proof
Writes a hash-chained evidence record with a snapshot of the key. When a dispute arrives, it re-verifies and builds the evidence pack.
evidence.jsonl
What it verifies today
Agent-commerce standards are still settling. This says plainly how far each one is implemented, and where we follow an assumption rather than a published rule.
| Standard | What is checked | Status |
|---|---|---|
| RFC 9421 HTTP Message Signatures | Ed25519, RSA-PSS-SHA512, ECDSA P-256. Passes the RFC's own Ed25519 test vector (B.2.6). | STABLE |
| Web Bot Auth | agent-browser-auth and agent-payer-auth tags, key directories, nonce replay. | STABLE |
| Visa Trusted Agent Protocol | Signature against the Visa JWKS; consumer-recognition and payment-container body objects. | BETA |
| Mastercard Agent Pay / Verifiable Intent | 3-layer SD-JWT chain (issuer, user, agent); amount, merchant and item constraints. | PREVIEW |
| AP2 (Agent Payments Protocol) | Cart mandate with merchant and user signatures; intent mandate with an unattended-amount threshold. | PREVIEW |
| Stripe shared payment tokens / ACP | Allowance limits: amount, currency, merchant, expiry. | LIMITS ONLY |
Details for each standard are in Protocols. Test vectors for other-language ports are in the repo.
Run the whole thing locally in 60 seconds
Node 18.17 or newer. No database, no accounts, no API keys. The playground loads a simulated day of agent traffic for a demo shop.
- Replay, tampered and over-limit scenarios
- Every check, with the raw headers
- YAML policy with a dry run
- Evidence packs for a sample dispute
$ git clone https://github.com/noelps-git/provethebuy.git $ cd provethebuy $ npm install $ npm run demo Then open http://localhost:4319
When the chargeback lands, the record does the talking
The verifier is free forever. ProveTheBuy Cloud keeps the records and handles agent-order disputes on Stripe for you.
- 13 months of records with the key archive, so old orders still verify after an agent rotates its key.
- A fight-or-accept verdict on every agent-order dispute, with the reasons.
- A readable certificate an issuer can check, submitted to Stripe in one click or by your rules.
VI, ES256TAP, Ed25519nonce oksha256 9f2c…c821Questions developers ask
Something missing? Open an issue.
Will it block real customers?
Not unless you tell it to. It starts in shadow mode and only records decisions. Requests without an agent signature come back as not_agent and pass straight through. If the verifier itself errors, the order goes through by default.
Does it touch card data?
No. It reads agent signatures, signed mandates and payment token limits. It never decrypts payment containers or sees card numbers, so it adds nothing to your PCI scope.
Which runtimes and frameworks work?
Node 18.17 and newer, with Express middleware included. The core takes a plain request object, so other frameworks need a few lines. Python and Go verifiers are planned and will pass the same test vectors.
How does a dispute months later still verify?
Each record keeps the raw signed request and a snapshot of the key used that day, chained by hash. Re-verification uses that snapshot, so it works even after the agent rotates its key.
What does it cost?
The verifier and CLI are free and Apache-2.0. Cloud has a free plan for up to 1,000 verified orders a month, and paid plans from $9 a month for dispute handling. See pricing.