The connective tissue
The Trust Spine
Explore receipt integrity and proposed integrations.
The Trust Spine demonstrates a shared receipt format. The product integrations below are proposals pending acceptance for each exact release. A matching receipt signature checks token integrity against this service; it does not establish the truth of a submitted verdict, authenticate the named product, or provide independent certification.
Receipt-format demonstration
Use synthetic examples only. The demonstration signs user-entered text and checks whether the token matches the service key. It does not investigate the subject or validate the verdict. Production key management and product integration require separate security acceptance.
1 · Sign synthetic example text
2 · Check the token with this service
Proposed receipt integrations
How it’s built
A compact, JWS-style token — the receipt’s claims, plus an HMAC-SHA256 authentication tag over them. The service compares tags in constant time after checking their lengths. HMAC uses a shared secret; this is not independent public-key verification. The local implementation permits its development fallback key only outside production and hosted environments. Hosted signing fails closed until a separate secure key is configured. Integration and key-management review remain required. Endpoints: POST /api/receipt to issue, GET /api/verify?token= to verify.