1 · DID mint

2 · AP2 credential

3 · FiscalGate

4 · Settle

5 · Article 12

6 · Verify

—

Agent identity

shopping-bot

awaiting mint…

did:mp:········································

Reputation

—

Agent FICO

—

Charge attempt

$5.00 · Stripe rail · 1 sku

idle

FiscalGate precheck—

Per-tx limit ($50)—

Monthly cap ($200)—

Allowed rail—

Charter category match—

Receipt —

AP2 verifiable credential

W3C VC v2 · AgentPaymentCredential · Ed25519Signature2020

// Credential will appear here once the pipeline runs.

Article 12 audit chain

EU AI Act § 12 record-keeping · Merkle-anchored

0 events

Run the pipeline — events will stack here as each step fires.

Merkle root (audit-chain head) —

Bundle verification

Re-verify the credential's Ed25519 signature in your own browser.

Not verified yet

Run the pipeline first, then hit Verify.

Try with your own agent ID

Prove the pipeline isn't smoke-and-mirrors. Drop any string (your agent's slug, your name, whatever) and rerun. It writes into the credential subject and the audit chain.

Ship this in your own agent today.

Everything you just watched is the public @mnemopay/sdk — Apache 2.0, free, on npm. The full pipeline is ~40 lines of code on top of the SDK.

npm install @mnemopay/sdk View pricing

Source · the actual SDK calls

› 1. Mint a DID

import { mintDid } from "@mnemopay/sdk/identity";

const { did, publicKey, privateKey } = mintDid();
// did === "did:mp:8b2f…ed25519 self-certifying"

› 2. Sign an AP2 credential

import { toAp2Credential } from "@mnemopay/sdk/identity";

const cred = toAp2Credential({
  did, publicKey, privateKey,
  agentName: "shopping-bot",
  reputationScore: 742,
  ficoEquivalent: 720,
  spendingMandate: {
    monthlyLimitUsd: 200,
    perTransactionLimitUsd: 50,
    allowedRails: ["stripe", "lightning"],
    categories: ["office-supplies"],
  },
  charter,
  auditChainRoot,
});
// W3C VC v2 / AP2 v0.2 shape, Ed25519-signed.

› 3. FiscalGate precheck

import { fiscalGate } from "@mnemopay/sdk/governance";

const decision = await fiscalGate({
  amountUsd: 5,
  rail: "stripe",
  category: "office-supplies",
  credential: cred,
});
if (decision.allowed === false) throw decision.reason;

› 4. Record on Article 12

import { recordEvent } from "@mnemopay/sdk/audit";

await recordEvent({
  did, kind: "charge.settled",
  refReceiptId: receipt.id,
  amountUsd: 5,
});
// Appends to the operator's signed Merkle chain.
// EU AI Act § 12 record-keeping, by default.

› 5. Verify the bundle

import { verifyAp2Credential } from "@mnemopay/sdk/identity";

const result = verifyAp2Credential(cred);
if (result.valid) console.log("trusted");
else console.error("rejected:", result.error);
// → "proof_invalid" | "expired" | "key_mismatch" | ...

Honest note

This playground uses the raw Ed25519 keypair via Web Crypto API rather than SPKI-DER (which the Node SDK uses on the server). The cryptographic primitive is identical — bytes-on-the-wire are the same — only the key-encoding wrapper differs. Real production verifiers handle both.

Watch the agent-trust pipeline work in 30 seconds.

Watch the agent-trust pipeline
work in 30 seconds.