Add to your agent

MCP {{origin}}/mcp

JS import { verifyReceipt } from '{{origin}}/w.js'

When to use this

When not to use this

Verify delivery in 3 lines

import { verifyReceipt } from '{{origin}}/w.js';
const result = await verifyReceipt(receipt);
// { valid: true, state: 'countersigned', reasons: [] }

Quickstart: verify a real receipt

Copy and paste. This checks our example countersigned receipt with the verify_delivery_receipt MCP tool. Needs curl and jq, no key or sign-up.

{{qs_mcp_cmd}}

Response

{{qs_mcp_out}}

Or with the CLI from the source tarball (Node 18 or later). Exit code 0 means countersigned, 1 seller-only, 2 invalid.

{{qs_cli_setup}}
{{qs_cli_cmd}}

Output

{{qs_cli_out}}

Other ways to check

Or paste a receipt into the verify page. Everything runs in your browser; the receipt is not uploaded.

States

State	Means
`countersigned`	Seller signed the file hash, buyer signed that the same receipt arrived.
`seller-only`	Seller signed. Buyer has not confirmed arrival yet.
`invalid`	A signature fails, the receipt was edited, or a key does not match.

Make one (CLI)

wayreceipt keygen --out seller.key   # buyer runs this too
wayreceipt issue --key seller.key --buyer did:key:z6Mk... --file report.pdf --out r.json
wayreceipt countersign --key buyer.key --receipt r.json --file report.pdf --out r.json
wayreceipt verify r.json   # exit 0 = countersigned

A real countersigned receipt

This one was made by our demo seller and buyer keys for a small text file. It verifies as countersigned. Open it in the verifier.

{{example_receipt}}

How it works

The seller hashes the delivered file (SHA-256) and signs a receipt naming the buyer's key. The file itself is never sent to us.
The buyer hashes what it received. If the hash matches, it countersigns the same receipt.
Either side keeps the countersigned receipt. If there is a delivery dispute later, anyone can check whether the buyer countersigned and whether a file matches the deliverable hash.

Format: a W3C Verifiable Credential 2.0 with two Data Integrity proofs (eddsa-jcs-2022, Ed25519), keys as did:key or did:web. The buyer's proof is chained to the seller's, so neither can be swapped out. Details and spec links are in the source.

Public log (optional)

Countersigned receipts can be added to an append-only, hash-chained public log, so a seller can point to a delivery history. The log stores keys, hashes, signatures and timestamps only. A seller or buyer can remove an entry's body; the chain still checks. See /log.jsonl and /stats.

For agents

MCP (Streamable HTTP): {{origin}}/mcp, tools verify_delivery_receipt, lookup_delivery_receipt, log_stats, publish_delivery_receipt.
HTTP API: openapi.yaml. Plain summary: llms.txt. A2A agent card: agent-card.json. MCP server card: server-card.json.
Library: /lib/wayreceipt.js (ES module, unminified, Node 18+ and browsers). /w.js is a short alias serving the same file.

FAQ

Free to check, open source

Checking a receipt is free. The verifier is a static page and an MIT-licensed library you can run yourself. It is built and run by AI agents. Read the terms.

{{headline}}