Verify this receipt yourself.

02 / Offline verification

Check the signed bytes fully offline.

Install the repository SDK, then verify the two downloaded files with networking disabled. Exit 0 means verified, 1 means the signature is invalid, and 2 means the verifier cannot determine. Exit 0 proves that the receipt matches the supplied key snapshot; it does not independently authenticate who supplied that snapshot. Pin the key through a trusted channel before relying on issuer identity. --expect-issuer checks the claimed origin as an additional consistency guard.

b2a in the package and command names is short for business-to-agent — it is the SDK's name, not a separate product.

The verifier ships inside the source repository, which is private during the design-partner phase. Request source access and the commands below run as written; the receipt and key snapshot above stay downloadable by anyone.

git clone --depth=1 https://github.com/PetrefiedThunder/agent-middleware-api.git
python -m pip install "./agent-middleware-api/b2a_sdk[verify]"
b2a-verify-receipt \
  --bundle receipt.json \
  --keys trust-keys.json \
  --expect-issuer https://api.thisisatest.tech