Verify a receipt

A Glyt receipt says one human operator approved one specific action. Checking it needs no account, no API key and no call to Glyt — the signature and the action binding are both verifiable offline, which is the entire point of the thing.

Three checks run below: the ed25519 signature over the envelope, the action binding (the action you are about to run must be the action that was approved), and the validity window.

See it pass, then make it fail

A verifier you cannot break proves nothing: a green tick and a picture of a green tick look the same. So here is one approval — "send £250.00 to ACME Supplies Ltd" — in three states. Each differs from the first in exactly one place.

Valid receipt Change the amount → Edit the receipt →

These demo receipts are signed by a demonstration key, not by Glyt. Its seed is a constant in our source and therefore public, so anyone can mint one — deliberately, because a validly-signed receipt for an approval that never happened would be a forgery, however we labelled it. That is also why a relying service must check the issuer:

• demo issuer — did:key:z6Mkghz7PMuxEnkUxFgJDd91iFSRdjAuKf4rKdrhH82AdGWB
• real issuer, as published at /.well-known/glyt.json — did:key:z6Mkp7GyL41vJMfZ9WkXK2obfMgaGEz3QnbofG6XZULzWJti

Check your own

The action you are about to run (JSON)

The receipt envelope (JSON)

Verify

Same check the SDKs run locally, and the same one behind POST /api/v1/verify.