Karenpay

Inspiration

AI agents are becoming capable of doing more than answering questions. They can initiate transactions, purchase products, and move money on behalf of people. But as AI gains more control over financial actions, one important question remains: How do we ensure that the person actually approves what the AI is about to do?

A simple “yes” should never be enough if the transaction can change, the recipient can be misunderstood, or an approval can be reused.

We were particularly inspired by the challenges blind and low-vision users face when interacting with digital financial services. While sighted users can visually review transaction details before confirming, users who rely on audio need to trust that what they hear is exactly what gets authorized.

We wanted to rethink the moment of consent in AI-powered payments.

That led to KarenPay: an idea built around one principle — no money should move until the account owner has heard the exact transaction details and explicitly approved that specific action.

What it does

KarenPay is an open-source consent layer that adds a human-verified security checkpoint between an AI agent and a financial transaction.

It ensures that an AI agent cannot independently authorize or execute a payment. Every proposed transaction must first be converted into a structured mandate, checked against the user’s original request, read aloud using a fixed template, and explicitly approved through biometric authentication using a passkey.

We demonstrate this through a voice-first web application designed for blind and low-vision users.

Here’s how it works:

Speak: The user makes a payment request naturally, such as “Send 5,000 to Ade.”
Understand: Gemini interprets the request and identifies the intended action, recipient, and amount.
Validate: KarenPay’s consent layer checks the proposed transaction against the user’s original request.
Hear: The application reads the exact recipient, amount, and currency aloud. Confirmation remains disabled until the readout finishes.
Confirm: The user approves the transaction using their device’s fingerprint or face authentication through WebAuthn.
Verify and Pay: The server validates the signed approval, checks that it is authentic, unexpired, unchanged, and unused, then allows PayPal to process the payment.

KarenPay also demonstrates transaction tampering protection: if an amount is altered after the user has heard the readout, the server rejects the payment.

The same consent layer also supports merchant payments, demonstrating how developers can integrate secure human approval into different AI-powered payment experiences.

How we built it

We designed KarenPay as two connected components: an open-source consent layer and a voice-first reference application that demonstrates its capabilities.

Our technology stack includes:

• Node.js and TypeScript: Backend logic and the reusable consent layer. • Next.js: Voice-first web application and user interface. • Supabase: Data persistence and transaction-related records. • Gemini API: Natural-language interpretation of spoken payment requests. • Web Speech API: Speech input and spoken transaction readouts. • SimpleWebAuthn: Passkey registration and biometric-backed transaction approval. • PayPal Sandbox: Payment execution through PayPal Payouts and Orders. • Vercel: Application hosting and deployment.

At the heart of KarenPay is the transaction mandate. It contains the action, recipient, amount, currency, expiry, unique nonce, original request hash, and exact spoken readout.

This mandate is canonically serialized and hashed using SHA-256. The resulting hash becomes the WebAuthn challenge, binding the user’s approval to the exact transaction they heard.

On the server, we verify the signature, user verification, mandate integrity, expiry, and single-use status before attempting payment.

An important architectural decision is that the AI proposes, deterministic code validates, and the human authorizes. The AI never receives PayPal credentials or has the authority to approve transactions.

KarenPay never holds users’ funds. PayPal remains responsible for moving the money.

Challenges we ran into

One of our biggest challenges was designing a consent mechanism that could be both secure and genuinely accessible.

A conventional confirmation screen was not enough. We needed to ensure that the information spoken to the user was identical to the information being authorized and ultimately sent for payment.

We approached this by generating spoken transaction details from a fixed template rather than relying on AI-generated wording.

Another challenge was preventing transaction tampering and approval replay. A user might approve one amount, only for the transaction to be modified afterward. Similarly, an old approval could potentially be reused.

We addressed these threats through cryptographic mandate hashing, short-lived approvals, unique nonces, server-side verification, and single-use enforcement.

We also had to consider ambiguous voice requests, particularly when multiple contacts have similar names. KarenPay uses a contact-selection step to clarify the intended recipient before proceeding.

Finally, we had to balance ambitious security goals with a realistic hackathon timeline, keeping the focus on the consent infrastructure and its working reference application rather than expanding into an entire banking or financial management platform.

Accomplishments that we're proud of

What makes KarenPay exciting to us is that we are not simply adding another confirmation button to an AI payment experience. We are building a reusable security layer that puts the account owner back in control.

We are particularly proud of:

Designing an open-source consent layer that developers can integrate into AI-powered payment applications.
Making explicit human approval a requirement before an AI-proposed payment can proceed.
Binding spoken transaction details to cryptographic approval through WebAuthn.
Designing a voice-first payment experience with blind and low-vision users in mind.
Supporting both person-to-person transfers and merchant payments through PayPal’s sandbox.
Building around security principles such as fail-closed verification, transaction integrity, expiry, and single-use authorization.

We are also committed to publishing measurable security results, documenting attack scenarios, and being transparent about the limitations of our approach.

What we learned

We learned that making AI payments trustworthy requires more than accurate AI responses.

A model can correctly understand a request and still produce an action that should not be authorized. Security must therefore exist outside the model, enforced by deterministic checks that cannot be bypassed by the AI.

We also learned that authentication and informed consent are different things. A fingerprint can establish that the user approved an action on their device, but the user must first have a meaningful opportunity to hear and understand what they are approving.

Most importantly, accessibility should not be treated as an additional feature. Designing for people who cannot rely on visual confirmation exposed weaknesses in the traditional payment approval experience and pushed us toward a more explicit, verifiable consent model.

What's next for Karenpay

The hackathon is a starting point, not the finish line.

Our next steps include:

Completing and publishing the security test suite covering transaction tampering, replay attacks, expiry, and other attack scenarios.
Conducting moderated testing with blind and low-vision users and incorporating their feedback.
Validating our transaction mandate against the relevant AP2 schemas.
Expanding developer documentation and making the consent layer easier to integrate into existing AI applications.
Seeking independent security review to identify weaknesses beyond our own test scenarios.
Exploring a pilot with an appropriately licensed financial partner before considering real-money deployment.

Our long-term vision is to make explicit, human-verified consent a standard part of AI-powered financial interactions.

AI should be able to help us move money. But the decision to move it should always belong to us.

KarenPay — Hear it. Confirm it. Then it pays.