AP2 v0.2 · PayPal

Verify any AI-agent payment before you ship

Every payment Mandate makes carries AP2 v0.2 mandates: the customer’s signed limits, the merchant’s signed checkout, the agent’s closed mandates and signed receipts. Check them with public keys alone, in one call. Interoperability is tested against Google’s AP2 reference SDK.

Read the API docs Try it in one call OpenAPI spec

Start here

API docsGuides, the full API reference and search, generated by APIMatic.
SDKsTypeScript, Python and C#, typed and generated from the OpenAPI spec.
AI coding assistantsA context plugin that teaches Claude Code, Codex and others to integrate Mandate correctly.
OpenAPI and PostmanThe spec for any tool, and a Postman collection that runs the whole story with 42 checks.

Verify a payment in one call

You need only the PayPal order id the payment arrived with. No account, no key.

Terminal

# verdict for a PayPal order
curl $MANDATE/api/verify/5O190127TN364715T

# full evidence pack for a dispute
curl $MANDATE/api/ap2/orders/5O190127TN364715T

# the public keys it is checked against
curl $MANDATE/api/ap2/jwks

TypeScript SDK · generated by APIMatic

import { MandateApiClient, ServerEnvironment } from "mandate-api";

const mandate = new MandateApiClient({
  serverEnvironment: ServerEnvironment.Production,
});

const verdict = await mandate.verification.verifyOrder({
  paypalOrderId: "5O190127TN364715T",
});

// Safe only when both chains verify with public keys
if (verdict.ok && verdict.ap2?.ok) ship();

Also in Python and C# · tested against the real API (links open in new tabs)

Verification API

Public, read-only endpoints. The API docs have every request and response.

GET/api/verify/{paypalOrderId}Verdict for an agent payment: Mandate v1 checks, PayPal's own order record (read with the PayPal Server SDK: the signed amount was captured), and the AP2 v0.2 verdict (ap2) in one response.
GET/api/ap2/orders/{paypalOrderId}AP2 v0.2 evidence pack: merchant-signed checkout JWT, Checkout and Payment Mandate chains (SD-JWT), checkout and payment receipts, budget context, and every check with its result.
GET/api/ap2/jwksES256 public keys (JWKS) for everything Mandate signs: provider, agent, payment gateway, merchants and users. Keys are looked up by kid.
GET/api/seller?merchantId={id}A merchant's agent payments, newest first, with their verdicts.
GET/api/trustAll public keys, Mandate v1 (Ed25519, PEM) and AP2 v0.2 (JWKS) together.
GET/api/approvals/{id}/passkeyThe WebAuthn challenge for an approval: derived from the approval ID and the exact cart, so a device signature covers what is bought.
GET/api/receiptsMandate's signed, hash-chained decision log.
POST/api/receipts/verifyVerify a copy of the log you hold; names the first altered entry.

What the AP2 verdict checks

Following the AP2 specification’s dispute rules. Each check comes back with ok and a readable detail; the payment is safe to fulfil only when all pass.

checkout_signedThe checkout JWT is signed (ES256) by the merchant named in it.
checkout_chainThe Checkout Mandate chain verifies: the user's open mandate (or the user's own signature, when they approved) and the agent's closed mandate.
checkout_hashThe closed Checkout Mandate's checkout_hash is the SHA-256 of that exact checkout JWT.
checkout_constraintsThe checkout meets the open Checkout Mandate's constraints (autonomous purchases).
payment_chainThe Payment Mandate chain verifies the same way.
payment_matches_checkoutThe payment's transaction_id is the checkout hash, and its amount and payee match the checkout.
payment_constraintsThe payment meets the open Payment Mandate: amount range, budget for the period, recurrence, and the reference to the open Checkout Mandate.
checkout_receiptThe merchant's receipt is signed and references the closed Checkout Mandate.
payment_receiptThe payment gateway's receipt is signed, references the closed Payment Mandate and carries PayPal's order and capture IDs.
passkey_approvalPresent when the customer approved on their device: a WebAuthn (ES256) assertion whose challenge is recomputed from the approval ID and the merchant-signed cart, checked for origin, site, user verification and signature.

Use it in your tools

OpenAPI 3.1 spec (YAML): import it into Postman, or generate a client with APIMatic.
Postman collection: the whole story with 42 checks: sign rules, shop, approve, block a compromised agent, verify, detect tampering.
Java, PHP, Ruby and Go from the same spec: npm run sdk:generate -- go

How Mandate signs

Open Checkout and Payment Mandates are SD-JWTs signed by Mandate as Trusted Agent Provider after the user confirms their rules.
They delegate (cnf) to Mandate’s agent key, which closes each in-policy purchase with a key-binding hop.
Purchases the user approves are closed with the user’s key; with a passkey, the user’s device also signs that exact cart.
Seller and category rules are enforced by the gate before signing, against the live merchant registry.

Agents (MCP)

Any MCP client can shop under a user’s mandate with a private connection link from the Assistants page. Tools: get_mandate, search_products, get_product, buy. Every purchase goes through the same 7 rules.