{
  "id": "visa-tap.signatures.verify",
  "protocol": "visa-tap",
  "layer": "identity-trust",
  "role": "merchant",
  "status": "recommended",
  "title": "Verify Visa TAP agent signatures",
  "description": "Onboarded agents sign requests with RFC 9421 HTTP Message Signatures (aligned with Web Bot Auth), including created, expires, nonce and tag (agent-browser-auth or agent-payer-auth). Visa reports live agentic transactions in Europe since July 2026 with participating merchants and over 30 issuers.",
  "goal": "Separates trusted, credentialed agents from anonymous bots, without relying on IP addresses.",
  "note": "Tag agent-browser-auth marks browsing, agent-payer-auth marks checkout. Ed25519 in the examples. Usually verified at your CDN (Visa names Cloudflare and Akamai).",
  "how_to_implement": {
    "steps": [
      "Read Signature-Input and Signature headers.",
      "Fetch the key by keyid and verify the signature.",
      "Reject expired signatures and reused nonces."
    ]
  },
  "resources": [
    {
      "label": "Visa TAP specifications",
      "url": "https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications",
      "type": "spec",
      "publisher": "Visa"
    },
    {
      "label": "Visa TAP on GitHub",
      "url": "https://github.com/visa/trusted-agent-protocol",
      "type": "spec",
      "publisher": "Visa"
    },
    {
      "label": "Visa: live agentic commerce transactions across Europe (2 July 2026)",
      "url": "https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html",
      "type": "announcement",
      "publisher": "Visa"
    }
  ],
  "audit": {
    "method": "code_review",
    "automatable": false,
    "human": "Verify a sample signed request from the Visa TAP repo."
  },
  "how_to_verify": "Verify a sample signed request from the Visa TAP repo.",
  "artifacts": [
    "Signature-Input",
    "Signature"
  ],
  "depends_on": [
    "visa-tap.keys.retrieve"
  ],
  "status_note": "Tag agent-browser-auth marks browsing, agent-payer-auth marks checkout. Ed25519 in the examples. Usually verified at your CDN (Visa names Cloudflare and Akamai).",
  "verified": true,
  "slug": "visa-tap-signatures-verify",
  "category": "identity-trust",
  "url": "https://vreeman.ai/commerce/checklist#visa-tap.signatures.verify",
  "updated": "2026-10-12",
  "sources": [
    {
      "label": "Visa TAP specifications",
      "url": "https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications",
      "type": "spec",
      "publisher": "Visa"
    },
    {
      "label": "Visa TAP on GitHub",
      "url": "https://github.com/visa/trusted-agent-protocol",
      "type": "spec",
      "publisher": "Visa"
    },
    {
      "label": "Visa: live agentic commerce transactions across Europe (2 July 2026)",
      "url": "https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html",
      "type": "announcement",
      "publisher": "Visa"
    }
  ],
  "related_slugs": [
    "visa-tap-keys-retrieve"
  ]
}