Certification

The Agorio Compatible program recognizes merchants whose storefronts work cleanly with @agorio/sdk agents. It’s a marketing-grade badge — useful for merchants that want to signal “AI agents work here” to procurement buyers.

Levels

Compatible

Your storefront either:

• Implements UCP discovery (/.well-known/ucp) and the discovered services pass our smoke-test suite, or
• Has a merchant-adapter implementation in src/adapters/ or in the adapters registry.

This is the entry-level badge, where most certified storefronts will sit.

Compatible + AP2

You meet the Compatible bar and additionally:

• Accept AP2 SignedMandates at a documented payment endpoint.
• Pass verifyMandateShape() on inbound mandates.
• Honor the mandate expiresAt field.

This is a meaningful proof point for procurement use cases where the buyer’s signing key proves authorization.

Compatible + Attested

You meet the Compatible bar and additionally:

• Verify the X-Agorio-Attestation header on inbound agent requests via verifyAttestation().
• Reject requests with malformed, expired, or mismatched signatures.
• Document the per-agent secret rotation policy.

This is the strongest level — agent identity is cryptographically verified end-to-end.

How to apply

There’s no formal application yet. Open an issue in the repository tagged certification with:

• Your storefront URL.
• The level you’re claiming.
• Test results (a CI-runnable check script ships alongside v1.0).

The team reviews within two weeks and merges a PR adding you to the certified list in the adapters registry.

Revocation

Certifications can be revoked if:

• The storefront stops responding to the published API.
• A reported compatibility issue isn’t resolved within 30 days.
• The merchant requests removal.

Revocations are listed transparently in the registry’s history.