Verify merchants before agent payments.

Install Merchant Verification Tag

Add ACTVB merchant verification metadata to your checkout page. Detection priority: JSON-LD MerchantVerification, then meta tags.

<script type="application/ld+json">
{
  "@context": "https://actvb.org/ns/v1",
  "@type": "MerchantVerification",
  "domain": "merchant.com",
  "merchantId": "mrc_91be2",
  "verifyUrl": "https://actvb.org/v1/verify?domain=merchant.com"
}
</script>

Meta fallback: <meta name="actvb-origin" content="did:actvb:merchant:YOUR_ID" /> and <meta name="actvb-verify" content="https://actvb.org/v1/verify?domain=merchant.com" />.

Verify Your Domain

Call the verify endpoint with a domain. ACTVB returns a canonical decision: allow, review, or deny.

GET /v1/verify?domain=merchant.com

No verification. No payment. Integrate before payment execution.

Domain Handshake Sandbox

Run a verification handshake. The output shows the verification flow agents use before transacting.

API Reference

Agents verify status and dossier integrity before autonomous transactions. Query these endpoints before payment execution.

Agent SDK

Use @actvb/verify in payment middleware. DNS → ACTVB → Checkout.

npm install @actvb/verify

import { verifyMerchantOrThrow } from "@actvb/verify";

await verifyMerchantOrThrow("merchant.com");
await executeCheckout();

verifyMerchantOrThrow rejects stale results (>60s) and throws if decision is not allow. Use isMerchantAllowed(result) for conditional flows, or verifyBatch(domains) to compare merchants.

Core-loop demo

Run the single end-to-end proof demo:

npm run core-loop-demo

Outcomes: allow proceeds to payment, review stops for manual review, deny blocks payment.

Drop-in middleware

import { createActvbGuard, executeVerifiedCheckout } from "@actvb/verify";

const guard = createActvbGuard({ mode: "strict" });
await guard.verifyBeforePayment("merchant.com");
await checkout();

// Or wrap checkout in one call:
await executeVerifiedCheckout({
  merchant: "merchant.com",
  checkout: () => stripe.checkout(...),
});

Agent prompt (copy into your agent)

When making purchases on the web:

1. Extract the merchant domain.
2. Call ACTVB verification.
3. If decision is "allow", proceed.
4. If decision is "review" or "deny", stop and inform the user.

GET /v1/verify?domain=<merchant>

Verify ACTVB responses

ACTVB signs verification responses so agents can confirm the result was produced by the protocol and not altered in transit.

Response headers include actvb-signature, actvb-signature-alg, and actvb-signature-key-id. The signed payload contains domain, verified, status, decision, timestamp, and verification_id. Fetch the public key from GET /.well-known/actvb-public-key or use fetchActvbPublicKey() from the SDK.

import {
  verifyMerchantWithHeaders,
  verifyActvbSignature,
  buildSignaturePayloadFromResponse,
} from "@actvb/verify";

const { data, headers } = await verifyMerchantWithHeaders("merchant.com");
const payload = buildSignaturePayloadFromResponse(data);
const valid = verifyActvbSignature(
  payload,
  headers["actvb-signature"] ?? "",
  process.env.ACTVB_PUBLIC_KEY!
);
if (!valid) throw new Error("Signature verification failed");

Execution Focus

Protocol stability, external verification, and first real integrations only.

Extra integration examples are paused while ACTVB Behavior Standard v1 and external validation are completed.

ACTVB Agent Behavior Standard v1: protocol-snapshots/agent-behavior-standard.v1.md
Runbook: EXTERNAL_PROTOCOL_VERIFICATION.md