What makes an x402 receipt verifiable
The receipt is a JSON object canonicalised under RFC 8785 (JCS) and hashed with SHA-256. The hash is content-addressed: it is a deterministic function of the receipt fields, so a verifier who holds the receipt recomputes the same hash and confirms the bytes independently. No issuer call, no registry lookup, no AlgoVoi service. A JSON parser, JCS, and SHA-256 are the entire dependency. Because the canonicalisation rule is pinned in-band ascanon_version: jcs-rfc8785-v1, the receipt re-verifies under the exact rules it was issued under, years later, without an out-of-band registry.
The receipts AlgoVoi issues on x402
Each receipt chains to the previous one by
content_hash, so a verifier walks admission, then settlement, then refund under one byte-deterministic pin. Every value is a positive, byte-distinct record: a DENY receipt is not missing data, it is a verifiable artefact in its own right.
Verify one yourself
The hosted verifier confirms a content-addressed reference with no auth:Specification and authorship
The receipts and the canonicalisation discipline they pin are AlgoVoi-authored and specified in IETF Internet-Drafts:draft-hopley-x402-canonicalisation-jcs-v1— the JCS discipline (urn:x402:canonicalisation:jcs-rfc8785-v1)draft-hopley-x402-compliance-receipt— the admission receiptdraft-hopley-x402-settlement-attestation— the settlement attestation
algovoi-substrate (Python) and @algovoi/substrate (TypeScript), byte-for-byte identical on the same input.
See also
- Offline-verifiable agent receipts — verify with no service call
- AVM Proofpack — bind x402 settlement evidence to Algorand and Voi state proofs, offline
- Key-credential binding — bind the RFC 9421 request signature to an issued agent credential
- No-PII compliance receipts — screening evidence with no personal data
- Verify it yourself — reproduce every vector offline
- Canonicalisation substrate — the JCS discipline
- Substrate authorship and provenance — citable AlgoVoi authorship record