aqta-verify-receipt
Offline verifier for Seal receipts (ATTESTATION-v1).
Seal signs the model call at runtime. This package checks that signature without contacting Aqta. No account. Same algorithm as the npm package.
30-second check
pip install aqta-verify-receipt
aqta-verify-receipt receipt.json \
--key 9Y3Eiq6V8QjRDUM5nPqSwKIOPQaoEU4SbagfYFdvWa4
Default output is one compact line (words carry meaning; colour is optional):
✓ valid ALLOWED 2d41…871e94c pinned issuer key
Invalid:
✕ invalid signature mismatch 2d41…871e94c
Optional flourish (never the proof):
aqta-verify-receipt receipt.json --key <pinned> --pretty
# …
◈ seal intact · verified offline
Or pipe:
curl -sS https://api.aqta.ai/r/YOUR_RECEIPT_ID | aqta-verify-receipt - \
--key 9Y3Eiq6V8QjRDUM5nPqSwKIOPQaoEU4SbagfYFdvWa4
| Exit | Meaning |
|---|---|
0 |
valid |
1 |
invalid |
2 |
usage / IO |
Current production key id: aqta-att-01269bb4b6a7d950
(/v1/attestation/public-key).
Pin that string; do not re-fetch it inside a verify loop. Keys rotate and
receipts do not: a receipt verifies against the key current when it was
signed, and the permanent key record (with retired keys and their validity
windows) is at
app.aqta.ai/security/issuer-keys.txt.
Library
from aqta_verify_receipt import verify_receipt, fetch_published_public_key
# Once per environment: fetch, then pin somewhere you control.
trusted = fetch_published_public_key()
result = verify_receipt(receipt, trusted_public_key=trusted)
if not result.valid:
raise ValueError(result.reason)
CLI
aqta-verify-receipt <file|-> --key <base64url> [--no-strict] [--json] [--pretty] [-q]
aqta-verify-receipt <file|-> --integrity-only [--no-strict] [--json] [--pretty] [-q]
| Flag | Meaning |
|---|---|
--key |
Pin issuer identity (required for counsel-grade). |
--integrity-only |
Signature vs embedded key only; returns untrusted. Anyone can self-sign. |
--no-strict |
Allow unknown top-level fields |
--json |
One JSON object on stdout |
--pretty |
Optional human flourish after the compact line (not the proof) |
-q |
Silent; exit code only |
NO_COLOR=1 disables colour. Meaning never depends on colour alone.
Pinning is required by default. Without --key, pass --integrity-only
(embedded key only; anyone can self-sign; result is marked untrusted).
Dependencies
cryptography (>= 42) for constant-time Ed25519. Nothing else.
What this is not
Not a governance dashboard. Not a cost router. A small verifier for one signed model-call receipt. The novel part is the receipt format and offline verification model, not ASCII theatre.
Licence
Apache-2.0. Aqta Technologies Limited.
If you implement or cite the ATTESTATION-v1 format itself, credit under CC-BY-4.0: see the repo CITATION.cff.
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file aqta_verify_receipt-1.0.10.tar.gz.
File metadata
- Download URL: aqta_verify_receipt-1.0.10.tar.gz
- Upload date:
- Size: 18.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
d4b4b50379145b7a5979a03bfd135b87ad48f71e9236145e2428277af00b3392
|
|
| MD5 |
fbf2f5bb1dd7a1a39dd14c1485fdefc5
|
|
| BLAKE2b-256 |
13e6d34a4a597763ec7ca94e2f907992c7dffa49d0803ea1ef18388bb38ed840
|
Provenance
The following attestation bundles were made for aqta_verify_receipt-1.0.10.tar.gz:
Publisher:
release-pypi.yml on Aqta-ai/attestation-spec
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
aqta_verify_receipt-1.0.10.tar.gz -
Subject digest:
d4b4b50379145b7a5979a03bfd135b87ad48f71e9236145e2428277af00b3392 - Sigstore transparency entry: 2442283128
- Sigstore integration time:
-
Permalink:
Aqta-ai/attestation-spec@0a42574a85f32204f378ef6d81ed6b9243398ef6 -
Branch / Tag:
refs/tags/pyverify-v1.0.10 - Owner: https://github.com/Aqta-ai
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release-pypi.yml@0a42574a85f32204f378ef6d81ed6b9243398ef6 -
Trigger Event:
push
-
Statement type:
File details
Details for the file aqta_verify_receipt-1.0.10-py3-none-any.whl.
File metadata
- Download URL: aqta_verify_receipt-1.0.10-py3-none-any.whl
- Upload date:
- Size: 15.4 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via: twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
3862efe4e686d6969a95c55d097a413337d54978bc10381200efc9f4225c5d68
|
|
| MD5 |
c9a28d3f7430260f245a6aaa916052a6
|
|
| BLAKE2b-256 |
c0cdabeccfe0c9e18d5c7039f16f36b11087e37f5a0803f881252a9e8f9d847f
|
Provenance
The following attestation bundles were made for aqta_verify_receipt-1.0.10-py3-none-any.whl:
Publisher:
release-pypi.yml on Aqta-ai/attestation-spec
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
aqta_verify_receipt-1.0.10-py3-none-any.whl -
Subject digest:
3862efe4e686d6969a95c55d097a413337d54978bc10381200efc9f4225c5d68 - Sigstore transparency entry: 2442283324
- Sigstore integration time:
-
Permalink:
Aqta-ai/attestation-spec@0a42574a85f32204f378ef6d81ed6b9243398ef6 -
Branch / Tag:
refs/tags/pyverify-v1.0.10 - Owner: https://github.com/Aqta-ai
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release-pypi.yml@0a42574a85f32204f378ef6d81ed6b9243398ef6 -
Trigger Event:
push
-
Statement type:
