Exploring AP2 compatibility.
Attesso is a PSP-agnostic authorization and evidence layer, and it does not require AP2. We are exploring an AP2 v0.2 human-not-present adapter so mandates issued in other systems could enter the same runtime, with Attesso as the verifier, not the merchant or payment-method provider. No conformance or production compatibility is claimed yet.
AP2 stays outside the core product.
An adapter would check issuer trust and signatures before a mandate reaches the runtime, keep the original signed artifacts intact, and translate only lossless semantics. The native spending-control path remains fully usable without AP2.
- Verify issuer trust, signatures, audience, timestamps, version, type, pair binding, and replay.
- Preserve exact signed AP2 artifacts, source-specific digests, provenance, and disclosures.
- Translate only lossless supported semantics into the canonical policy and action runtime.
- Create AP2 Mandate Receipts only when Attesso is legitimately acting as the action Verifier.
Revocation is a lifecycle step.
AP2 v0.2 defines no revocation or status protocol for issued open mandates. Its safeguards are mandate expiry, reuse only after a rejection receipt, and verifier rejection.
In Attesso, withdrawal is a first-class lifecycle step: the mandate's subject revokes through the hosted passkey ceremony, the mandate and anything still open under it end together, and the revocation is recorded in the same signed evidence as the approval it ends.
Using AP2 mandates or exploring compatibility?
Discuss the supported profile, semantic boundaries, and evidence responsibilities with us.