AP2 and Mastercard Verifiable Intent (MC VI) sign ES256 JWS inputs with a P-256 key. Both use Keeper's authority, approval, and signing pipeline.
| Protocol | Authority type | Build selector | Guide |
|---|---|---|---|
| AP2 | ap2.mandate |
ap2 |
AP2 |
| MC VI | mcintent.mandate |
mc-vi |
MC Intent |
Build both with -Pkeeper.features=agentic-payments -Pkeeper.platforms=ecc, or select one feature from the table. Each guide contains a complete Edict authority and explains its request fields.
signingInput is the exact unpadded base64url JWS header and payload joined by .. Supply every disclosure referenced by the mandate. Keeper checks the disclosure commitments before evaluating the actions against authority policy. Signing preserves the supplied input. /v2/keeper/sign returns the raw signature. Composer returns a serialized PaymentCredential layer.
The caller supplies issuer, audience, nonce, time, and parent-binding claims. The recipient verifies the credential chain, merchant identity, audience, expiry, and replay rules. Keeper checks the outgoing layer's content commitments. Parent credentials and merchant signatures need verification by the recipient. See the module contract for supported profiles and disclosure rules.