Nityaflow receipt format

Version 0.1 (draft) · 25 October 2026

Every Nityaflow check ends in a receipt: a small JSON file that says what was checked, what the independent checker found, who approved it, and what was done. Anyone can confirm a receipt was not changed, and that Nityaflow signed it, using only the public key on this page. Nobody has to trust Nityaflow's server to do it.

What a receipt proves, and what it doesn't

• It proves the receipt's contents are exactly as they were when it was signed, that Nityaflow signed it at the time shown, and (for chained receipts) where it sits in its owner's sequence of receipts.
• It does not prove that the files someone uploaded were true, that a payment happened on a real payment rail, or that the person named as approver is who they say. Those need other evidence.
• Nityaflow never holds or moves money. A receipt for a payment records a check and an approval; a licensed bank or payment app makes any real payment.

1. The body and its fingerprint

A receipt is a JSON object. Everything in it except fingerprint_sha256 and signature is the body. The fingerprint is the SHA-256 of the body in canonical form, written as 64 lowercase hex characters.

Canonical form: objects have their keys sorted (by plain string order) and are written {"key":value,...} with no spaces; arrays are written [a,b,...]; every other value is written as JSON (strings with JSON escaping, numbers as JSON numbers, null).

function canonical(v) {
  if (Array.isArray(v)) return "[" + v.map(canonical).join(",") + "]";
  if (v && typeof v === "object") return "{" + Object.keys(v).sort().map((k) => JSON.stringify(k) + ":" + canonical(v[k])).join(",") + "}";
  return JSON.stringify(v ?? null);
}

A workflow Receipt step uses one variation: its file is { receipt, items }, and the fingerprint covers { workflow, step, created_at, items }, with item_count equal to the number of items.

Common body fields

Payment receipts: mandate, intent and action

An agent-payment-check receipt adds the evidence for who allowed an AI agent to pay, what the person asked for, and what the agent tried to do:

Limits in a mandate are always the owner's settings. Presets based on reported NPCI limits (UPI Circle, Reserve Pay) are only starting points: those numbers come from press reports and may change.

2. The signature

Nityaflow signs a short text built from the fingerprint, with Ed25519. The signature object sits next to the fingerprint:

"signature": {
  "v": 2,
  "alg": "Ed25519",
  "kid": "nityaflow-receipts-1",
  "signed_by": "Nityaflow",
  "signed_at": "2026-10-25T16:05:44.764Z",
  "chain": { "id": "463a82f9c8f32d32", "seq": 2, "prev": "a1a1…a1" },
  "value": "<base64url Ed25519 signature>"
}

The signed text is:

v1 (no chain):  nityaflow-receipt:v1:<fingerprint_sha256>:<signed_at>
v2 (chained):   nityaflow-receipt:v2:<fingerprint_sha256>:<signed_at>:<chain.id>:<chain.seq>:<chain.prev>

Signatures without v are v1. Receipts made through the public tool for AI assistants are v1, because they belong to no account.

3. The chain

Each signed-in account has its own chain. Every receipt Nityaflow signs for the account gets the next number, and names the fingerprint of the receipt before it:

• chain.id: the first 16 hex characters of SHA-256 of "nityaflow-chain:" + account id. It shows which receipts belong together without showing who the account is.
• chain.seq: 1 for the first receipt, then 2, 3 and so on.
• chain.prev: the fingerprint of receipt seq − 1, or genesis for the first.

Because the chain position is inside the signed text, nobody can reorder receipts, slip one in or quietly drop one without it showing: a missing number is a gap, and a wrong prev is a broken link. Asking Nityaflow to sign the same fingerprint again keeps its first place in the chain. On the Verify page, open several receipt files at once to check the links.

4. The public key

{ "kty": "OKP", "crv": "Ed25519", "x": "2NNm64TPrUlQETtnxm3SvGPwDBiKQ0URxC_aYBSAhEc" }

5. Check a receipt yourself

This runs in a modern browser or in Node 20 and later, with no Nityaflow code:

const KEY = { kty: "OKP", crv: "Ed25519", x: "2NNm64TPrUlQETtnxm3SvGPwDBiKQ0URxC_aYBSAhEc" };
const b64u = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4)), (c) => c.charCodeAt(0));
const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, "0")).join("");

async function checkReceipt(r) {
  const { fingerprint_sha256: fp, signature: s, ...body } = r;
  const unchanged = hex(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical(body)))) === fp;
  const text = s.v === 2
    ? `nityaflow-receipt:v2:${fp}:${s.signed_at}:${s.chain.id}:${s.chain.seq}:${s.chain.prev}`
    : `nityaflow-receipt:v1:${fp}:${s.signed_at}`;
  const key = await crypto.subtle.importKey("jwk", KEY, { name: "Ed25519" }, false, ["verify"]);
  const signed = await crypto.subtle.verify({ name: "Ed25519" }, key, b64u(s.value), new TextEncoder().encode(text));
  return { unchanged, signed };
}

Changes to this format

This is a draft. New fields may be added; existing fields keep their meaning. A change that would alter how fingerprints or signatures are made gets a new version letter in the signed text (v3 and so on), and old receipts stay checkable. Suggestions are welcome at hello@nityaflow.in.