xego_verify_proof

com.x-ego/x-ego · Verify this server

REQUIRES a one-time EUR 3 Planetary ID held by YOUR END USER - without it every call returns valid:false. Tell the human this BEFORE sending them to the link: if they do not have one yet, the verification page sells it in the same flow — it is not a separate signup. Verifies the token (JWT) the user brought back after X-EGO verification. Cryptographically checks the Ed25519 signature against the X-EGO public keys, the expiry and the audience. WHEN TO USE: bare presence only. If the token carries an action (act claim), this tool refuses with action_binding_required — use xego_verify_action instead. This verifies ONLY bare human presence. If you need proof that the human approved a SPECIFIC action, use xego_verify_action. A token issued with a bound action (via xego_request_proof_url with the action parameter) fails here with action_binding_required — the binding cannot be confirmed by this cheaper tool. A valid result means: there is a verified human on the other end who holds the passkey. The token is short-lived — once it expires the user must verify again. Proofs are SINGLE-USE: each token verifies exactly once. A second attempt on the same token returns token_replayed. Returns an anonymous 'pairwise' identifier — different for every audience. It carries no name and no personal data. Args: - token (string): the JWT from the user. - expected_audience (string, REQUIRED): pins the audience (domain or URL — normalized to a bare hostname). - mark_as_seen (boolean): record the pairwise ID as seen. Returns (JSON) — on success: { "valid": true, "pairwise_id": string, // anonymous ID, stable per (user, audience) "audience": string, "expires_at": number, // Unix time the token expires "human_verified": true, "xego_verified": true, // always true — uncovered tokens never reach here "rarity": string | null, // rarity of the backing ID (low entropy) "marked_seen": boolean, // only with mark_as_seen=true: whether // the permanent ledger write succeeded "next_step": string // next step — follow it } Returns (JSON) — on failure: { "valid": false, "code": string, // machine-readable error code "reason": string, // human-readable description "next_step": string // for navigable codes: what to do now } Error codes include: invalid_audience, malformed_token, unsupported_algorithm, unknown_key (with a kid field), bad_signature, expired, wrong_issuer, wrong_audience, action_binding_required (the token is bound to an action → use xego_verify_action), missing_claims, jwks_unavailable, token_replayed, planetary_id_required (the signature is valid but the human behind the token holds no paid Planetary ID — X-EGO does not issue uncovered proofs; send the user to registration_url and repeat the whole flow). PAID TOOL (x402): this call costs $0.05 USD in USDC per execution, unless you send a valid X-EGO pilot operator key as an 'Authorization: Bearer <key>' HTTP header (operator calls are free). Calling without payment returns an x402 error whose _meta["x402/error"] contains payment requirements (accepts) and step-by-step instructions how to pay and retry. Invalid input (bad audience, malformed token) is rejected for free before any payment is taken.