Verify a receipt in the browser
Paste a Trustvice signed receipt into /verify and check its Ed25519 signature in your own browser.
Use caseThe job
Someone handed you a Trustvice receipt and you want to know whether it is genuine and unchanged, without an account and without asking Trustvice for the answer.
Before you start
- Account
- None
- Credential
- None: verification needs only public keys
- You also need
- A browser whose WebCrypto supports Ed25519
- The receipt as JSON
Steps
Paste the receipt
Open
/verifyand paste the receipt. The page fetches Trustvice's published Ed25519 keys and checks the signature in your browser; nothing is sent to Trustvice for the verdict.Link straight to a check
To send someone a check they can open, put the URL-encoded receipt JSON in the
receiptparameter. The page opens with the receipt filled in.URLhttps://trustvice.com/verify?receipt=<URL-encoded receipt JSON>Read the verdict
A valid receipt shows when it was signed and by which key. Otherwise the page names the reason: a malformed receipt, an unknown key or a signature that does not match.
What you can rely on
You can rely on
- Trustvice signed the receipt with a published key.
- Nothing in the receipt has changed since.
Do not assume
- That the facts in the body are true where a caller supplied them.
- Anything about events the receipt does not mention.
Every statement above comes from the Trustvice docs linked on this page. Where a docs page says more, it is the reference.
Next steps
Related recipes
Call an Agentic API action
Mint an OAuth access token, find an action in the public catalogue and call it at POST /api/v1/actions/<id>.
Confirm a destructive action
Handle 412 confirmation_required: mint a confirmation token and replay the call with X-Trustvice-Confirmation.
Connect an MCP client
Add the Trustvice MCP server at https://mcp.trustvice.com/mcp to Claude Code, Cursor or VS Code.
New recipes by email
One short email when we add recipes to the cookbook. No other mail, and you can unsubscribe from any message.
Start with the Agentic API.
One POST endpoint per registered action, with the same behaviour over REST and MCP. The docs list every action with its input and permissions.