Sandbox

Same agent. Two actions. One commits, one stops.

Both receipts below are real ES256-signed v2.2 receipts — the same format the production gateway emits. Click Verify on either side to run the four-check verification. Click Open receipt to see the full audit chain.

Same agent. One transfer in scope. One that breaches the spend cap.

Vendor transfer · in scope

USD 50.00

EXECUTED

Deterministic execution pipeline · 8 steps · all passed

#1
Authorisation token verified
token_validation
2ms
#2
Request shape validated
schema
3ms
#3
Boundary policy passed
boundary
5ms
#4
Required fields present
completeness
2ms
#5
Risk + anomaly check
math
8ms
#6
Provider call
execute
800ms
#7
Commit authorisation
commit_auth_split
4ms
#8
Receipt signed
receipt
120ms

spec: ep-receipt/2026-04-27
event: ORIGINAL
payment: charged
algorithm: ES256
kid: sandbox-2026-05

Vendor transfer · out of scope

USD 9200.00

BLOCKED

Deterministic execution pipeline · 3 steps · halted

#1
Authorisation token verified
token_validation
2ms
#2
Request shape validated
schema
3ms
#3
Boundary policy passed
boundary
5ms
#4
Required fields present
completeness
#5
Risk + anomaly check
math
#6
Provider call
execute
#7
Commit authorisation
commit_auth_split
#8
Receipt signed
receipt
120ms

spec: ep-receipt/2026-04-27
event: ORIGINAL
payment: not_charged
algorithm: ES256
kid: sandbox-2026-05

Try a different pair

Hotel reservation Vendor transfer Customer data export

About this sandbox

• Both receipts are signed with ES256. The sandbox keypair is published at /.well-known/jwks.json with EP-extension lifecycle fields.
• Receipts are deterministic per fixture. Pasting the JSON into /verify always returns valid; tamper one byte and verification fails.
• Canonicalisation follows RFC 8785 JCS. The same wire format the production gateway uses.
• No signup, no rate limit beyond a per-IP bucket, no persistence beyond the in-process receipt store.

Production posture — KMS-signed receipts, persistent audit chain, multi-replica JWKS — is documented on the Security page.

About this sandbox

• Both receipts are signed with ES256. The sandbox keypair is published at /.well-known/jwks.json with EP-extension lifecycle fields.

• Receipts are deterministic per fixture. Pasting the JSON into /verify always returns valid; tamper one byte and verification fails.

• Canonicalisation follows RFC 8785 JCS. The same wire format the production gateway uses.

• No signup, no rate limit beyond a per-IP bucket, no persistence beyond the in-process receipt store.