Hosted signer demonstration

Verify a receipt yourself.

This page sends the displayed metadata fixture and policy to AgentGuard's hosted authorization gate. The server evaluates those caller-supplied fields and signs the resulting record with its configured Ed25519 key. Validate that signature, then change a signed field and see validation fail. No account or API key is required.

Step 1 · mint & verify, live

Mint a hosted receipt, then verify it.

"Mint" calls the hosted gate at /api/gate/authorize and returns a signed receipt. "Verify" posts it to /api/verify, which checks the Ed25519 signature against the AgentGuard signer key. "Tamper" edits the signed amount and re-verifies, so you can see the altered receipt rejected.

No receipt verified yet. Mint one, or paste your own and press Verify.

Each gate or verification action is a request to agentguard.run. Open your network tab and inspect it.

Step 2 · the signer key

Identify the signer, then validate locally.

The receipt carries the signer's public key and an 8-byte fingerprint. This page fetches AgentGuard's published JWKS and uses the hosted verifier. Offline verification is possible after you have the verifier code, receipt, and trusted public key locally. This demonstration's private key stays on the AgentGuard server; the displayed metadata fixture and policy are sent to that server.

fetching signer key from/.well-known/jwks.json

Step 3 · from your own terminal

The same round-trip in curl.

Copy these into a terminal. The first sends the displayed metadata and policy to mint a receipt, the second verifies it, and the third edits the amount and gets it rejected. The fixture contains no prompt, completion, customer record, or provider key.

# 1. mint a signed authorization receipt (metadata only)
curl -s https://agentguard.run/api/gate/authorize \
  -H "content-type: application/json" -d '{
    "tenant_id":"demo","agent_id":"support-agent","capability_claim":"payment_execute",
    "action":{"type":"refund","amount_cents":14250,"currency":"USD","target_system":"payments_processor"},
    "policy":{"id":"refunds-tier-1","version":"1","window":"per_day","window_cap_cents":500000,
      "rules":{"refund":{"required_capability":"payment_execute","review_above_cents":40000,"hard_block_above_cents":200000}}}
  }' | tee receipt.json | jq .decision

# 2. verify it (expect ok: true)
jq '{receipt: .receipt}' receipt.json | curl -s https://agentguard.run/api/verify \
  -H "content-type: application/json" -d @- | jq .

# 3. tamper: change the amount, verify again (expect ok: false)
jq '{receipt: (.receipt | .action.amount_cents = 1)}' receipt.json | curl -s https://agentguard.run/api/verify \
  -H "content-type: application/json" -d @- | jq .

What this validates

Signature integrity, not external facts.

A valid result shows that the signed fields validate under the selected AgentGuard public key and have not changed since signing. It records how the hosted gate evaluated the caller-supplied policy and metadata. It does not establish who supplied those fields, whether an external action occurred, or whether that action was safe, compliant, or correct.