Verifying AI Agents Before They Transact: RelayShield's TAP Verifier

Description and use

RelayShield’s TAP Verifier enables merchants to quickly and fully validate AI agent credentials by combining signature verification, Visa key checks, threat intelligence, and intent mismatch detection into a single API call.

Problem

Merchants lack a streamlined way to fully verify TAP credentials, leading to potential fraud when agents with valid signatures but malicious intent transact.

Outcome

The verifier consolidates multiple verification steps into one call, enabling merchants to validate TAP credentials fully without becoming cryptography or threat intelligence specialists.

Workflow

• Receive TAP credential and request context via POST to https://api.relayshield.net/v1/tap/verify
• Reconstruct RFC 9421 signature base and validate against presented key
• Fetch agent’s public key from Visa JWKS endpoint and confirm key validity
• Screen agent identity indicators against RelayShield’s TI corpus (687K+ indicators)
• Compare declared intent in TAP credential with actual request pattern to detect intent mismatch
• Return verdict with signature status, JWKS key match, TI hits, and intent assessment

Evidence

The verifier reconstructs the signature base from the request components and validates it against the presented key material.

Agent public keys are fetched from Visa's JWKS endpoint and matched before any signature check runs.

The agent's identity indicators are screened against RelayShield's threat intelligence corpus (687K+ indicators drawn from monitored criminal marketplaces).

The verifier compares the agent's declared intent in the TAP credential against the actual request pattern.

The verifier is live and the core path works, but two verifications are still in progress and we want to be upfront about them: Signed Visa JWKS test with real Visa keys and Intent-mismatch live production test.