CRYPTOGRAPHIC AUTHORITY LAB
The browser lab proves mathematical integrity with an ephemeral key and deliberately returns a non-executable result. Live authority additionally requires your server-side trust registry and mandate.
STRUCTURAL CRYPTO LAB
Your browser creates an ephemeral P-256 key, signs a synthetic purchase and sends only the public key and signature. This proves signature and input binding—not trusted authority. No payment or private key leaves this device.
The v2 endpoint fails closed on missing, expired, modified or wrongly addressed evidence.
OFFLINE-VERIFIABLE EVIDENCE
Receipts are ES256-signed JWTs. Anyone can verify them with the public JWKS without trusting a screenshot, database export or verification API. Signature and digest checks run locally through Web Crypto.
The strict API accepts compact JWS, an AP2-shaped closed-payment SD-JWT projection with RFC 9901 KB-JWT, and normalized TAP-shaped RFC 9421-style evidence. The wider AP2 checkout/delegate chain and raw Visa TAP structured-field/trust-store processing remain external. Caller-supplied keys are structural tests; only account-pinned keys can create a live reservation, and a separate audience-bound PROCESSOR key must still consume it before provider submission.
Signatures must be current and bound to the evaluated merchant, amount, audience, nonce or canonical purchase digest.
Each decision receives a signed receipt containing input and decision digests, evidence assurance and the verifier engine version.