RelayPay

Approval receipts for AI-placed orders: the cafe approves, PayPal holds the fingerprint, and disputes get real evidence.

Comment

Inspiration

AI agents are starting to place orders for businesses. When one of those payments is disputed as unauthorized, the merchant usually has little to show: what the agent proposed, who approved it, and whether that's what was charged. In PayPal's Agentic Commerce Pulse Report (498 US merchants), almost two-thirds agree a standardized liability framework for AI-initiated purchases is needed. Dispute tools argue after the fact. We wanted the record to exist before the payment.

What it does

A coffee supplier (the PayPal merchant) runs RelayPay to offer an AI reordering service to its cafe customers.

  1. The purchasing agent proposes. It checks the cafe's low stock, inventory, today's budget and live market prices (Channel3), then proposes an order. It cannot pay.
  2. The cafe approves. RelayPay recomputes the price from the catalog, re-runs the checks, and seals the approval (what, how much, who, when, every check that ran, the model and prompt hash) into a receipt fingerprinted with SHA-256.
  3. The supplier charges. The cafe saved its PayPal once with Vault, so RelayPay creates and captures a PayPal order with the receipt's fingerprint as custom_id. PayPal now holds an independent copy.
  4. Verify with PayPal. RelayPay re-reads the order from PayPal and checks four things: the receipt is unchanged, PayPal's custom_id equals the fingerprint, the amount matches, and the capture completed. Anyone holding the receipt can check it on a public page.
  5. The dispute agent. When a payment is disputed, a second agent checks the case against the receipt and PayPal's own record. It recommends contesting only when PayPal holds the same fingerprint, then drafts the response and an evidence PDF. The supplier decides what is sent.

What the receipt shows, precisely: it existed when PayPal took the payment, it hasn't changed since, and PayPal holds an independent copy of its fingerprint. It is a tamper-evident approval record.

How we built it

  • PayPal (sandbox): Vault v3 (setup and payment tokens), Orders v2 (create with vault_id + custom_id, capture), Payments v2 (PayPal's copy of custom_id), Disputes v1 (list, show, provide-evidence with PDF, accept-claim, sandbox require-evidence) and Webhooks (signature verification; unsigned events are rejected).
  • AI: two real tool-calling agents on subconscious/glm-5.3-marathon (OpenAI-compatible API). The model chooses the tools; the backend runs them and enforces every rule. Prices come from the catalog, never from the model.
  • Channel3: the market price check, sealed into each receipt.
  • AG Grid: receipts, ledger and webhook tables with quick filter, CSV export, custom renderers and pinned actions.
  • Render + Neon Postgres: hosted demo with atomic writes, row locks and database-backed rate limits.
  • Next.js 15, React 19, TypeScript. 109 tests against a fake PayPal and LLM, CI on every push.

Challenges we ran into

  • Stable fingerprints: Postgres JSONB reorders object keys, which changed hashes. We canonicalize the receipt (sorted keys) before hashing.
  • Fitting PayPal's limits: the fingerprint had to fit custom_id (127 characters), and an order that returns APPROVED needs an explicit capture. Only a COMPLETED capture counts.
  • Irreversible actions: evidence can be submitted only once, so RelayPay re-verifies against a fresh PayPal read first, and uses idempotency keys and in-flight locks.
  • Honest claims: we kept the agents from overclaiming. A sealed receipt is tamper-evident; it doesn't by itself prove who clicked approve.

Accomplishments that we're proud of

The whole loop runs on the real PayPal sandbox: agent proposal, cafe approval, Vault charge, verification against PayPal, a signed webhook, and a dispute with an evidence PDF. Judges can run it on the hosted demo without a PayPal login.

What we learned

custom_id turns PayPal into an independent witness for any record you can hash. And the most useful thing an AI agent can do in payments is often to leave a trail someone else can check.

What's next

A signed-in cafe portal so the receipt records an authenticated approver, multiple cafe's per supplier, and aligning the receipt format with agent mandate standards such as AP2.

Built With

Share this project:

Updates

Submission history