Cat-1 · T667 · AI & Agentic Developer Tooling
v1.0

Visa Trusted Agent Protocol Header Verifier

Visa's Trusted Agent Protocol (TAP) has a merchant-side proxy verify an agent's identity on every request, using HTTP Message Signatures (RFC 9421). Paste a Signature-Input and Signature header pair and this tool runs a fixed 9-point verification checklist: it parses the headers, checks the components a TAP signature must cover, rebuilds the RFC 9421 signature base and shows it to you, checks the algorithm against an allowlist, and (only if you also paste a public key) runs a real cryptographic verification locally with WebCrypto.

⚠ This tool validates TAP as pinned at commit 16d59bdf of visa/trusted-agent-protocol (2025-10-28). The upstream repo is labeled a sample implementation and carries no version string, so re-check this page's citations if a versioned spec ships later. It never calls the Agent Registry /keys/{key_id} endpoint or any other network address: paste a public key or a registry JSON record if you want the signature actually checked, otherwise that one check is honestly marked NOT-RUN.
Visa TAP RFC 9421 Zero PII Client-Side · No Network
Scope & reliance: 🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only. This is a structural and (optionally) cryptographic check of the headers you paste, not a live call to Visa or any merchant. Licensing note: use of the reference implementation is governed by the Visa Developer Center Terms of Use and the Trusted Agent Protocol Product Terms; the full text of those terms is not machine-retrievable and is linked below rather than quoted. Deterministic logic · no inference · zero PII · runs offline · CC BY 4.0.
▸ Paste the headers to verify
An example TAP-shaped signature is pre-loaded. The request line and public key are both optional: without them, checks 4 through 6 are as complete as the pasted headers allow, and are labeled accordingly.