About SynOI receipts
A receipt is a signed record that something happened, that anyone can check.
When the SynOI Gateway allows or blocks an AI action, or someone accepts an agreement through SynOI, the gateway writes down what happened and signs it. That signed record is a receipt. Change one character of it and the signature stops matching, so a receipt that checks out is exactly what the gateway signed.
What is in a receipt
Four parts, and the ID is derived from the content.
The record
What happened, in plain fields: for an AI action, the action, the policy decision, and who approved it; for an agreement, which document was accepted (its version and SHA-256 hash) and the signer's public key.
The time
When the gateway recorded it. This is the gateway's own clock, stated inside the signed record. Independent third-party timestamping is planned, not yet shipped.
The signature
The gateway's digital signature over the exact bytes of the record. For an agreement, the signer's own signature is inside the record too, so both sides have signed.
The receipt ID
A SHA-256 hash of the record's content (it starts with sha256:). Same content, same ID. The ID is how you look a receipt up, and it changes if the content does.
Kinds of receipt
The same format, used for two jobs today.
Decision receipts
Written by the SynOI Gateway when an AI agent attempts a governed action. It records whether policy allowed it, denied it, or held it for a human, and who approved it. This is how a team proves after the fact that a risky tool call was approved before it ran.
Decision receipts →Agreement receipts
Written when someone signs an agreement through SynOI, such as the mutual NDA at nda.synoi.systems. The signer's browser creates a key and signs the document's hash; the gateway checks that signature and counter-signs. The receipt shows which exact text was agreed to and when.
The SynOI mutual NDA →What a receipt proves
Precise about what it shows, and what it does not.
It shows
- The record has not changed since the gateway signed it.
- It was signed by the key the gateway publishes.
- For an agreement: the exact document, by hash, that the signer’s key signed.
- For an AI action: the decision the policy reached, and who approved it if a human was asked.
It does not show
- Who a key belongs to. An agreement receipt proves a key signed; the name and email are on the signer’s copy, and on the public receipt only if the signer chose to add them.
- That the recorded time is independent of SynOI. The time is the gateway’s clock until third-party timestamping ships.
- That an action was a good idea. A receipt records the decision, not whether the policy was right.
What is public
A receipt ID is shareable. Personal details stay off it by default.
Anyone with a receipt ID can look the receipt up, so receipts are built to be safe to share. An agreement receipt, by default, records only the signer's public key and the document's hash: no name, email, address, or phone number. Those details go on the signed copy that the signer keeps and that is emailed to them. A signer can choose to add their name and email to the public receipt when they sign; it is off unless they turn it on.
How to check a receipt
Three ways, and they prove different things.
Look it up
Open the receipt's link, or paste its ID at verify.synoi.systems. The gateway fetches the receipt and confirms the signature server-side. Quick, but it is SynOI telling you the answer.
verify.synoi.systems →Check it in your browser
On the same site, choose Verify in my browser. Your browser re-runs the signature check itself against the key carried in the receipt.
How the verifier works →Check it in your own code
Run npx @synoi/verify on your own machine, or use any standard signature library with the published key. This is the check that does not depend on SynOI at all.
Receipt format spec →