Ropeline Proof · early access

Proof that every AI purchase is real

AI agents like ChatGPT's now buy things for people. When one buys from you, Ropeline checks it really is that agent, signs a receipt at that moment, and gives you the evidence if the shopper disputes the order later. It works alongside the bot protection you already have: that checks the agent at the door, Ropeline checks the purchase.

Add it to your checkout Check a receipt

What happens at the moment of purchase

1. The agent is checked
Real AI agents sign every request (the Web Bot Auth standard). Ropeline checks the signature against the key the agent's company publishes: a verified agent, or a fake using its name.
2. A receipt is signed
For a verified agent's order, Ropeline signs a receipt on the spot: which agent, its key, the time, your store, the order and its items. Changing any of it afterwards breaks the signature.
3. Card testers are stopped, agents aren't
Verified agents go through at agent speed. A "ChatGPT" that can't prove it is stopped as the card tester it is.

Why ordinary fraud rules get AI shoppers wrong

A real agent goes from search to checkout in under a second, never opens your pages, and comes from its company's servers, whose few addresses carry every shopper using it. To a fraud system that looks exactly like card testing. So stores either turn good agents away or loosen their rules for anything claiming to be one, and card testers walk through.

Ropeline's rules go by the signature instead. A verified agent is never limited by its address, isn't asked to open the checkout page, and still gets through during a card-testing attack. It's counted by card and by email: one shopper's card failing 5 times in an hour locks that card for an hour, not the agent. Everyone else gets the rules Ropeline Pro uses on WooCommerce: 6 tries in 10 minutes per address, 5 failed payments in an hour lock an address, email or card for an hour, and 10 failed payments in an hour across the store start attack mode for 2 hours.

When a shopper disputes an AI purchase

"My agent bought that, I didn't mean it." Dispute rules weren't written for AI agents, so the store needs proof of what happened. A receipt's evidence pack says in plain words who placed the order and when, lists the order, and carries everything needed to check it without trusting you or us. Download it as a PDF, or let the Ropeline app for Stripe add it to the dispute for you.

It's honest about what it shows: the order came through a real agent run by, say, OpenAI, at the time stated, for your store, and you recorded the order then, before any dispute. It identifies the agent, not the person using it.

Check a receipt

Handed an Agent Receipt? Paste it here to see whether it's genuine.

Or check it with your own tools: a receipt is a JWS (RFC 7515) signed with EdDSA (Ed25519) by a key published at getropeline.com/.well-known/ropeline-receipt-keys.json. The agent's own signature is inside it, with the key it was made with.

For developers: one call at checkout

From your server, when an order is placed, send us the request your checkout received (its address, method and signature headers), the order, and a little about the shopper. You get a decision back, and a receipt when the shopper is a verified agent.

curl https://getropeline.com/api/proof/checkout \
  -H 'authorization: Bearer RL-XXXXX-XXXXX-XXXXX-XXXXX' \
  -H 'content-type: application/json' \
  -d '{"request": {"method": "POST", "url": "https://shop.com/checkout",
                   "headers": {"signature-agent": "...", "signature-input": "...", "signature": "..."}},
       "order": {"id": "1042", "amount": 4599, "currency": "usd", "payment": "pi_3Q...",
                 "items": [{"name": "Blue mug", "quantity": 2, "amount": 1500}]},
       "shopper": {"ip": "203.0.113.7", "email": "jo@example.com", "card": "the card's fingerprint",
                   "seen_checkout": false, "returning_customer": false}}'

{"ok": true, "checkout": "chk_...",
 "decision": {"action": "allow", "kind": "agent", "reason": "Verified AI agent from chatgpt.com"},
 "agent": {"status": "verified", "operator": "chatgpt.com", "name": "ChatGPT agent (OpenAI)", ...},
 "receipt": {"id": "rcpt_...", "token": "eyJ...", "url": "https://getropeline.com/api/proof/receipts/rcpt_..."}}

decision.action is allow or block, and kind says why: agent, returning, attempts, locked, attack or spoof.
When a payment fails, tell us, so the rules can count it: POST /api/proof/outcome with {"checkout": "chk_...", "outcome": "failed"}.
Taking payments with Stripe? Send the payment's ID as order.payment, or put the receipt's ID on the payment as the metadata ropeline_receipt, so the Ropeline app for Stripe can find it if the payment is disputed.
Only want receipts? POST /api/proof/receipts with request and order. Read one back with GET /api/proof/receipts/ID; add ?format=text for the evidence pack as text, or /evidence.pdf for the PDF.

Send amounts as whole numbers in the currency's smallest unit (4599 for $45.99). Never send the shopper's name, address or card number. Receipts keep only the order's number, total, items and payment ID, for 540 days, the longest the card networks give a shopper to dispute. The shopper's address, email and card fingerprint are kept only as hashes, for a day, to count failed payments. Up to 3,000 receipts an hour per key. Privacy

The Ropeline app for Stripe

For any store that takes payments with Stripe, on any platform:

Card-testing alarm. It watches your failed payments. 10 or more in an hour looks like card testing: the app shows the alarm in your Stripe Dashboard and emails you what to do, once per alarm.
Receipts on disputes. When a shopper disputes an AI agent's purchase that has a receipt, the app adds the evidence pack to the dispute in Stripe, as text and a PDF. It doesn't submit it: you review it and submit it yourself.

Get the Ropeline app on the Stripe App Marketplace: install it from there, in your Stripe Dashboard.

Early access

Agent Receipts, the checkout rules and the evidence packs come free with any Ropeline Pro key while they're in early access. Start a free trial to get a key. Running a larger store or a platform? Email hello@getropeline.com.

Not sure where your store stands? The free AI agent check shows whether real AI shoppers can buy from you, and whether a fake gets in too.