Verify a receipt
Check that a receipt was signed by us and hasn't been changed. The file stays in your browser; only our public key is fetched.
How to verify yourself
No need to trust this page. The check needs Node.js 18+ and our public key.
The signature covers a JSON array of the receipt fields in a fixed order. Fetch the key from /api/receipt-key, save the receipt as receipt.json, and run:
// verify.mjs — Node 18+: node verify.mjs receipt.json
import { readFileSync } from "node:fs";
import { createPublicKey, verify } from "node:crypto";
const { receipt: r, keyId, signature } = JSON.parse(readFileSync(process.argv[2], "utf8"));
const key = await (await fetch("https://test.tacet.dea.web.id/api/receipt-key")).json();
if (key.keyId !== keyId) throw new Error(`receipt key ${keyId}, current key ${key.keyId}`);
const msg = JSON.stringify([r.v, r.orderId, r.status, r.network, r.from, r.to, r.amountIn,
r.amountOut, r.payoutTxid, r.refundAmount, r.refundTxid, r.finalAt, r.issuedAt]);
const ok = verify(null, Buffer.from(msg), createPublicKey(key.publicKeyPem), Buffer.from(signature, "base64url"));
console.log(ok ? "signature valid" : "signature INVALID");