How to validate an AP2 payment mandate at runtime

Before accepting the payment

• Verify the payment mandate signature with a trusted key.
• Bind the payment mandate to the expected cart or checkout hash.
• Compare the final amount and currency with the authorized limits.
• Confirm merchant identity and permitted merchant scope.
• Reject expired or excessively long authorization windows.
• Require explicit consent and a stable intent reference.
• Atomically consume the idempotency key once.
• Return a structured reason for every non-ALLOW decision.
• Store a minimal receipt without payment credentials.

Why replay prevention must be durable

An in-memory set disappears when a worker restarts and does not coordinate concurrent regions. The consume-once decision belongs in a database with a uniqueness constraint on API key plus idempotency key. That turns simultaneous duplicate requests into one successful insert and one blocked replay.

Test the normalized mandate

MandateShield's public validator accepts the policy-relevant AP2 fields and returns exact findings without requiring payment credentials.