A signed record you can check.
Paste a signed receipt below. This page checks its hash and Ed25519 signature in your browser without submitting the receipt to a server.
Check the record.
Know its limits.
A valid signature establishes integrity under the signing key. It does not establish a real-world delivery or a compliance outcome.
Open the signed sampleSample data is fictionalThree reasons to paste a receipt here.
Finance teams at month-end: check the authorization and economic details recorded in a signed receipt.
Sellers reviewing a request: verify the recorded terms and result digest, then compare them with your delivery evidence.
Security reviewers: inspect the verifier and check a receipt's signature and bound fields against the selected key.
Every vendor says trust us. This page is how you check.
Five steps, all offline.
The same check a receipt would get from the standalone Python verifier GateCore publishes at examples/verify_receipt.py, ported to run in a browser tab instead of a terminal.
GET /v1/receipts/{request_id}Paste a receipt.
Works with the full envelope from GET /v1/receipts/{request_id}: {receipt, payload_sha256, signature, signing_key_id, alg}.
GateCore's API blocks cross-origin browser requests by design (see below), so this page cannot live-fetch the current key list. The active production key ships embedded above. If you're checking a receipt signed under a rotated or retired key, paste that key set instead.
Use a different key
Verify the original request binding (advanced)
Optional. GateCore receipt_version 2 carries request.request_sha256, the hash of the exact bytes the agent's own signature covers. If you also hold the original signed request JSON, paste it here to check that binding, and optionally the agent's Ed25519 public key to check the agent's own signature.
The key endpoint is public. Browser access to it is not.
GET /v1/receipts/keys is unauthenticated on purpose. Anyone verifying a receipt needs the public key, with no account. What it does not do is answer cross-origin browser requests: GateCore's CORS policy allows only its own applications to call the API from a browser tab. Confirmed directly against the live endpoint before this page shipped: a preflight from this origin comes back 400 Disallowed CORS origin. That is a locked-down security posture, not an oversight, so this page embeds the key instead of fetching it.
One active key, one date.
- The kid and PEM currently returned by the live endpoint
- A provenance line naming when and where it was fetched
- Rotation adds a kid; it does not invalidate old receipts
You don't have to trust our copy.
Call api.gatecoreai.com/v1/receipts/keys yourself, from a terminal or server, and paste what it returns into "Use a different key" above. Or skip this page entirely and run examples/verify_receipt.py, the same reference verifier this page's canonicalization was checked against.
Read this before you trust a green result.
The selected key verifies these signed bytes.
- The receipt was signed by the named key, under GateCore's receipt domain
- A change to signed payload bytes invalidates the corresponding hash or signature check
- The receipt binds its included identity, decision, execution, and settlement fields in the signed payload
GateCore is still the issuer.
- A compromised signing key could sign a false receipt at issuance time
- A receipt proves an action happened; it can't prove no other action happened
- Execution status is what the gateway observed, not the target's real-world outcome
Read the full model, including the ledger's hash chain and off-box checkpoint anchoring, on the security page.
Questions, answered.
Where do I get a receipt to paste here?
GET /v1/receipts/{request_id} on your gateway returns the exact envelope this page expects: {receipt, payload_sha256, signature, signing_key_id, alg}. The Operator Console's Activity view links a transaction to its receipt for download.Why receipt_version 2, specifically?
What does a failed check usually mean?
payload_sha256, signature, or signing_key_id). A genuine tamper produces the same failure, which is the point.Does this page call GateCore, or anyone, over the network?
Bring your security team. Bring your receipts.
See how signed evidence would fit your workflow. Ask us to walk through a request for your use case.
Request a demo