One place to install the SDK, verify a receipt from the command line, read the protocol and the open spec, and browse the reference implementations in five languages. Every link here goes to the real, open resource on GitHub or npm. Nothing is behind a login.
Add the package to your project, then check any receipt file straight from the command line. The CLI ships with the package, so there is no separate binary to install.
# install the SDK (Apache-2.0, published on npm)
$ npm install @askledger/receipts-sdk
# verify a receipt file from the command line
$ npx @askledger/receipts-sdk verify receipt.jsonThese are the ideas the specification is built on. Each card links to a plain-language definition in the glossary or to the mechanics on the how-it-works page.
A signed, structured record of a single AI action, with inputs, outputs and policy context captured at the moment it happened.
Read the definition →Each receipt links to its predecessor by hash, per tenant, so a missing or altered entry breaks the chain and shows up.
Read the definition →Receipts are canonicalized before signing (RFC 8785 JCS), so the same data always produces the same bytes and the same signature.
Read the definition →How much a given receipt can be trusted, based on what was signed, timestamped and chained. Higher levels carry stronger evidence.
Read the definition →A receipt can carry an evidence_refs array that references external evidence by hash, so large artifacts stay out of the receipt but stay tamper-evident.
The end-to-end path: wrap the call, sign the receipt, chain it, timestamp it, and verify it later against a public authority.
See how it works →Prevent, record, trace, prove correct, then govern. Layers 1 to 4 are the technical proof engine, each an independent API; Layer 5 is the governance, compliance and ROI program that wraps them.
Build by layer →TypeScript is published on npm now. Python, Go, Rust and Java live in the same open monorepo and share one set of conformance vectors, so a receipt signed in any of them verifies in the others. All are Apache-2.0. The other four build from source today; we publish each to its own registry as it hardens.
The protocol document explains the receipt format and how verification works. The open spec holds the machine-readable schemas and conformance vectors. Both are public and Apache-2.0 licensed, and both build on established standards rather than anything proprietary. The receipt format itself is an open specification anyone can implement, published as a candidate for standardisation; no standards body has adopted it yet.
The verifier checks any receipt in your browser, with no account and nothing to install. The playground lets you generate and inspect receipts interactively to learn the format.
Paste or upload a receipt and confirm its signature, chain and timestamp in the browser.
Open the verifier →Generate sample receipts and step through the format field by field to see how signing and chaining fit together.
Open the playground →A short walkthrough of what verification checks and why each check matters, with the same open verifier embedded.
Go to the verify page →Found a security issue in the SDK or spec? Please report it privately through GitHub security advisories.
Everything above is open and free to use. Start with the SDK, wrap a call, and verify the receipt. When you are ready, the developers page walks you through it in your language.