Agent identity that is earned, not claimed

Every delivery produces a signed receipt. It names the resource, the amount, the time and the SHA-256 of the artefact handed over, and it carries its own Ed25519 public key — so it verifies without calling us, and we cannot repudiate one later.

An agent identity in circulation today is a string the agent writes about itself: a User-Agent, or a key typed into a form. Our own request logs are the evidence that this is worth nothing. They contain 105 distinct “identities”, not one of which can be checked, and one of them was a company's email address pasted into a User-Agent field.

So a merchant standing in front of a wallet knows nothing about it. Not whether it has ever paid anyone. Not whether it will pay again. Not whether the last thing it bought was delivered. The one party that could answer those questions is a merchant, because a merchant is where the paying happens. That is the position we are in, and this is what we do with it.

Identity is a settlement history

A receipt accumulates against a fingerprint derived from the wallet that paid — not from anything the agent said about itself. Identity stops being a claim and becomes a list of things you have actually paid for.

We publish fingerprints, never addresses. A merchant's record of who bought what is not ours to make public; whether a given wallet has a history is exactly the question another merchant needs answered. A fingerprint answers the second without exposing the first.

No score

There is deliberately no rating here. A score is an opinion, and an opinion is something the reader has to decide whether to trust — which puts the problem back where it started. What we publish is the count of settled events, each backed by a receipt the reader can check for themselves. The reader reaches their own conclusion. That is the whole point.

Or bring your own key

An agent that registers an Ed25519 public key is identified by that key, not by a wallet address. The difference matters: an address says where money sat, a key says who the agent is, and the agent can prove it holds the key without revealing anything else. The history then travels with the agent instead of with one wallet, and a merchant anywhere can check it.

POST https://growaify.com/api/v1/agents/register
{"name": "procurement-bot", "purpose": "buys booking systems for clients",
 "public_key": "<64 hex characters>"}

A name alone still gets an API key, but the response will say it was identified by "identified_by": "wallet" rather than "key" — and that distinction is published rather than hidden, because it changes how much the record is worth.

Two forms, one of them the ecosystem's

The compact receipt is ours. The Verifiable Credential is not: it follows the ACK-Pay PaymentReceiptCredential shape on the W3C Verifiable Credentials data model, signed Ed25519Signature2020, issued by did:web:growaify.com.

That matters more than it sounds. A receipt only we can verify is a press release — a verifier would have to take our word for it. A credential in the standard shape is readable by any VC-aware system, and the issuer DID resolves to a document carrying our public key, so nobody needs an arrangement with us to check one.

GET https://growaify.com/.well-known/did.json      the key, resolvable from the DID
POST https://growaify.com/api/v1/attest/verify      either form

Read it, or verify it yourself

GET  https://growaify.com/api/v1/attest/summary
GET  https://growaify.com/api/v1/attest/agent/<fingerprint>
GET  https://growaify.com/api/v1/attest/receipt/<receipt_id>
POST https://growaify.com/api/v1/attest/verify        {"receipt": {...}}

Signing key: 2a7c6f53fcb62d1cae7bbfa821499cec49ff3c0796a423935fc812e82c6f1bb1

The ledger is append-only and hash-chained. An entry that is edited or removed breaks the chain from that point on, which any reader can see for themselves — a ledger you have to take on trust is not evidence of anything.