Verify this receipt yourself.

02 / Offline verification

Check the signed bytes fully offline.

Download the receipt, the key snapshot, and the standalone verifier below. The downloads need no account and no key. After the downloads, run the verification with networking disabled. Exit 0 means verified, 1 means the signature is invalid, and 2 means the verifier cannot determine. Exit 0 proves that the receipt matches the supplied key snapshot; it does not independently authenticate who supplied that snapshot. Pin the key through a trusted channel before relying on issuer identity. --expect-issuer checks the claimed origin as an additional consistency guard.

curl -fsSLO https://www.thisisatest.tech/proof/receipt.json
curl -fsSLO https://www.thisisatest.tech/proof/trust-keys.json
curl -fsSLO https://www.thisisatest.tech/proof/verify_receipt.py
python3 -m pip install cryptography
python3 verify_receipt.py \
  --bundle receipt.json \
  --keys trust-keys.json \
  --expect-issuer https://api.thisisatest.tech

The verifier is a standalone script published on this page: it checks the signature over the receipt's hashes using the supplied key snapshot, with no account and no call back to the gateway. Anyone with a source checkout can use the SDK CLI b2a-verify-receipt instead. The same public key set is also served live, with no key needed, at https://api.thisisatest.tech/.well-known/trust-keys.json (and https://api.thisisatest.tech/.well-known/jwks.json).