AVA Pay for WooCommerce

Description

AI agents are already shopping your store. ChatGPT browses product pages, agentic checkouts are rolling out across the ecosystem. AVA Pay tells you which agents to trust, lets you set the rules, and records every verification and attributed order so you can see the traffic when reporting lands.

This plugin connects your WooCommerce store to the AVA Pay verification API, which cryptographically verifies agent traffic across protocols (Visa Trusted Agent Protocol, IETF Web Bot Auth, Google AP2) through a single endpoint.

What it does

• Adds a verify endpoint (/wp-json/ava-pay/v1/verify-agent) that proxies signed agent requests to the AVA Pay API. Signatures are verified server-side against the agent platforms’ published keys.
• Applies YOUR policy: accept/reject verified agents, per-platform allow/challenge/block rules, discount caps, and spend limits, kept as a portable JSON policy document.
• Optionally mints a single-use, expiring WooCommerce coupon for verified agents.
• Shows signed AI agent visits to your store. When an AI agent loads a page with its requests signed (ChatGPT’s agent does; most crawlers do not), the plugin checks the signature with the AVA Pay API after the page has been sent and lists the result under WooCommerce, Agent visits: counts for the last 7 and 30 days by agent platform and outcome, and the last 50 visits. This only observes: a page view is never blocked, redirected or given a coupon because of it. You can turn it off in the settings.
• Records every verification and every attributed order in local database tables. (Agent page visits are shown as above; a traffic and revenue dashboard for the verify endpoint and orders is planned, and that data is not displayed yet.)

Trust model, honestly stated

• Verification proves agent identity and request integrity. A discount is only granted beyond your identity-only tier when the request carries a buyer mandate.
• Everything fails closed: if the verification API is unreachable, agents are not admitted (and the outcome is recorded as an error).
• We do not claim to have blocked an agent we never managed to check. When the verification API cannot reach an agent’s trust root, the request is still not admitted, but it is recorded as unverifiable rather than as a rejection, and the storefront response says verification_unavailable instead of agent_blocked.
• The plugin never blocks human shoppers. A failed agent verification means “no discount, proceed normally.”

External services

This plugin connects to the AVA Pay verification API, operated by Agentic Verification Architecture LLC, to check whether an AI agent’s signed request is genuine. Your store cannot verify agent signatures on its own; this API does the cryptographic check against the agent platforms’ published keys.

• Service: AVA Pay verification API. The plugin sends POST https://pay.avalayer.com/verify. The base URL is the “AVA Pay API URL” setting (default https://pay.avalayer.com) and can also be changed with the ava_pay_api_url filter.
• When data is sent: in two cases. (1) When a request is POSTed to the plugin’s verify endpoint, /wp-json/ava-pay/v1/verify-agent, and passes the local rate limit. That endpoint is how signed agent requests reach the plugin, either directly from the agent or from the storefront script on a page view that carries agent signature parameters. (2) When a front-end page request (GET or HEAD) carries agent signature headers (Signature and Signature-Input), the “Verify signed AI agent page visits” setting is on, and the visit is not skipped (checks run one at a time, within a per-agent and per-site budget, and an agent whose last check could not complete is paused for 10 minutes); this happens after the page has been sent. The plugin forwards each such request, with only the headers listed below, and lets the API decide; a request without valid signature material is rejected there. Nothing is sent for page views without agent signature headers, in the admin, or during checkout.
• What is sent: the incoming request’s HTTP method; the URL, which for the verify endpoint is its canonical URL built from your site’s own address rather than from the incoming request, and for a page visit is the page’s URL as the agent requested it (the Host header it sent plus the path and query string); only the request headers verification needs, which are Signature, Signature-Input and Signature-Agent, every header the agent’s signature names as covered, the protocol headers the verifier reads by name (X-Ava-Mandate, X-Ava-Discount-Hint, the AP2 mandate headers, Content-Digest, and Content-Type when there is a body), and Host, replaced by your site’s own host on the verify endpoint and sent as received for a page visit; and the request body, if there is one (a page visit has none). Every other header is dropped before the request leaves your site, including X-Forwarded-For and User-Agent (unless the agent’s signature covers it). Cookie, Authorization, Proxy-Authorization and X-WP-Nonce are never forwarded, even when the agent’s signature covers them.
• What is not sent: no customer, order, or session data. No cookies, no logged-in user information, no cart contents, no visitor IP address, and no store settings or policy.

Terms of service: https://avalayer.com/terms
Privacy policy: https://avalayer.com/privacy

Technical details