內容簡介
AVA Pay for WooCommerce 外掛能夠將您的 WooCommerce 商店連接至 AVA Pay 驗證 API，幫助商家識別和驗證 AI 代理的流量，並根據自訂政策管理代理訪問，提升商店的安全性和效率。
【主要功能】
• 連接 AVA Pay 驗證 API 進行代理流量驗證
• 自訂接受/拒絕代理的政策與規則
• 記錄每次驗證和訂單至本地資料庫
• 顯示簽名的 AI 代理訪問統計
• 可選擇為驗證過的代理發放一次性優惠券
外掛標籤
開發者團隊
原文外掛簡介
AI agents are already shopping your store. ChatGPT browses product pages, agentic checkouts are rolling out across the ecosystem. AVA Pay tells you which agents to trust, lets you set the rules, and records every verification and attributed order so you can see the traffic when reporting lands.
This plugin connects your WooCommerce store to the AVA Pay verification API, which cryptographically verifies agent traffic across protocols (Visa Trusted Agent Protocol, IETF Web Bot Auth, Google AP2) through a single endpoint.
What it does
Adds a verify endpoint (/wp-json/ava-pay/v1/verify-agent) that proxies signed agent requests to the AVA Pay API. Signatures are verified server-side against the agent platforms’ published keys.
Applies YOUR policy: accept/reject verified agents, per-platform allow/challenge/block rules, discount caps, and spend limits, kept as a portable JSON policy document.
Optionally mints a single-use, expiring WooCommerce coupon for verified agents.
Shows signed AI agent visits to your store. When an AI agent loads a page with its requests signed (ChatGPT’s agent does; most crawlers do not), the plugin checks the signature with the AVA Pay API after the page has been sent and lists the result under WooCommerce, Agent visits: counts for the last 7 and 30 days by agent platform and outcome, and the last 50 visits. This only observes: a page view is never blocked, redirected or given a coupon because of it. You can turn it off in the settings.
Records every verification and every attributed order in local database tables. (Agent page visits are shown as above; a traffic and revenue dashboard for the verify endpoint and orders is planned, and that data is not displayed yet.)
Trust model, honestly stated
Verification proves agent identity and request integrity. A discount is only granted beyond your identity-only tier when the request carries a buyer mandate.
Everything fails closed: if the verification API is unreachable, agents are not admitted (and the outcome is recorded as an error).
We do not claim to have blocked an agent we never managed to check. When the verification API cannot reach an agent’s trust root, the request is still not admitted, but it is recorded as unverifiable rather than as a rejection, and the storefront response says verification_unavailable instead of agent_blocked.
The plugin never blocks human shoppers. A failed agent verification means “no discount, proceed normally.”
External services
This plugin connects to the AVA Pay verification API, operated by Agentic Verification Architecture LLC, to check whether an AI agent’s signed request is genuine. Your store cannot verify agent signatures on its own; this API does the cryptographic check against the agent platforms’ published keys.
Service: AVA Pay verification API. The plugin sends POST https://pay.avalayer.com/verify. The base URL is the “AVA Pay API URL” setting (default https://pay.avalayer.com) and can also be changed with the ava_pay_api_url filter.
When data is sent: in two cases. (1) When a request is POSTed to the plugin’s verify endpoint, /wp-json/ava-pay/v1/verify-agent, and passes the local rate limit. That endpoint is how signed agent requests reach the plugin, either directly from the agent or from the storefront script on a page view that carries agent signature parameters. (2) When a front-end page request (GET or HEAD) carries agent signature headers (Signature and Signature-Input), the “Verify signed AI agent page visits” setting is on, and the visit is not skipped (checks run one at a time, within a per-agent and per-site budget, and an agent whose last check could not complete is paused for 10 minutes); this happens after the page has been sent. The plugin forwards each such request, with only the headers listed below, and lets the API decide; a request without valid signature material is rejected there. Nothing is sent for page views without agent signature headers, in the admin, or during checkout.
What is sent: the incoming request’s HTTP method; the URL, which for the verify endpoint is its canonical URL built from your site’s own address rather than from the incoming request, and for a page visit is the page’s URL as the agent requested it (the Host header it sent plus the path and query string); only the request headers verification needs, which are Signature, Signature-Input and Signature-Agent, every header the agent’s signature names as covered, the protocol headers the verifier reads by name (X-Ava-Mandate, X-Ava-Discount-Hint, the AP2 mandate headers, Content-Digest, and Content-Type when there is a body), and Host, replaced by your site’s own host on the verify endpoint and sent as received for a page visit; and the request body, if there is one (a page visit has none). Every other header is dropped before the request leaves your site, including X-Forwarded-For and User-Agent (unless the agent’s signature covers it). Cookie, Authorization, Proxy-Authorization and X-WP-Nonce are never forwarded, even when the agent’s signature covers them.
What is not sent: no customer, order, or session data. No cookies, no logged-in user information, no cart contents, no visitor IP address, and no store settings or policy.
Terms of service: https://avalayer.com/terms
Privacy policy: https://avalayer.com/privacy
