Concept · proposed to PayPal · not a PayPal page
What PayPal's approval page could show
Today Maya checks her agent's fingerprint against a line the shop writes. We propose that PayPal show the terms it actually stores, with the agent's key fetched by PayPal itself. Everything below is built from the terms PayPal holds for her agreement.
Terms read live from PayPal: agreement 5td85928ph747680n, stored at her approval and unchangeable since.
Today, on PayPal's sandbox
PayPal's page shows one line: the plan name. The shop writes it, and PayPal doesn't store it.
Set up recurring payments to Good Boy Provisions: GBP-SR24, up to 1 per order every day, max USD 65.00 each, until 2027-03-31, agent GAX4 1xq- rZuP w9cM
The terms PayPal does store are never shown to her:
RB1 Good Boy Provisions | GBP-SR24 x1/1d | max USD 65.00 | 2026-10-15..2027-03-31 | agent GAX41xq-rZuPw9cM
So a dishonest shop could put her agent's fingerprint in that line and its own key in the stored terms (threat T21), and nothing in PayPal's records would show the difference.
Concept · not a PayPal page
Approve payments by your shopping agent
to Good Boy Provisions
- Your agent 1
- readback-agent.onrender.com
- Agent key 2
- GAX4 1xq- rZuP w9cM
- It may buy 3
- Up to 1 × Salmon & Rice Adult (24 lb) per order
- Spending limit
- $65.00 per order
- How often
- At most once a day
- Dates
- Oct 15, 2026 to Mar 31, 2027
- Unsigned charges 4
- Refused. Every charge must be signed with this key.
PayPal keeps these terms with your agreement, even after you cancel 5. The store can't change them, and PayPal checks every charge against them.
Where each line comes from
agent_terms.agent.jwk_uri. PayPal fetches the agent's key itself; the shop never supplies it. The domain shows her which agent she's trusting. Here, it's this demo's agent runtime.agent_key_thumbprint. PayPal computes it from that key (RFC 7638) and shows all 16 characters, grouped. Her agent shows the same characters.constraints: items, the maximum per order, the period, and the dates. PayPal renders them in its own words, instead of a line the shop wrote.require_agent_mandate. PayPal refuses an unsigned charge when it's made, as it refuses charges on a cancelled agreement today.deleted_at. The terms stay on the payment token after she cancels, so a later dispute can still read them.
Field names are illustrative, as in the proposal. The smallest step needs no new field: PayPal's page could show the stored terms above, as they are.
Readback's shopper page never shows the fingerprint, because the shop isn't the one to vouch for her agent. Today she compares her agent's fingerprint with PayPal's page. With this change, PayPal would fetch the key itself and check every charge against it.