Prove
Publish a one-time DNSSEC-signed TXT challenge. It binds your domain, wallet, chain and registry, and expires in 24 hours.
Start with your domainWhen an API asks your AI agent for money, PayTLS proves the payment address really belongs to that domain. DNSSEC proves the domain. Arc records the certificate. Your agent checks it in one call.
TLS proves you reached the real server. PayTLS proves you are paying the real service.
Publish a one-time DNSSEC-signed TXT challenge. It binds your domain, wallet, chain and registry, and expires in 24 hours.
Start with your domainBind a payment address, signing key, route scope and expiry. The contract verifies the full DNSSEC chain itself.
Issue a certificateYour agent reads the current certificate straight from Arc and compares it with the 402. Only valid: true may pay.
Verify a serviceA replacement atomically revokes the old certificate. Revoke outright after a leak. History stays public.
Manage certificatesPayment instructions pass through proxies, SDKs, plugins and tool calls. Any of them can swap the recipient while the request still looks right. PayTLS gives your agent an independent answer before it signs: does this domain authorize the address I'm about to pay?
The SDK pins every read to one Arc block. If any check fails, the result names the reason and your agent does not pay.
CERTIFICATE_NOT_FOUNDDOMAIN_MISMATCHCERTIFICATE_REVOKEDCERTIFICATE_EXPIREDPAYMENT_ADDRESS_NOT_AUTHORIZEDSIGNING_KEY_NOT_AUTHORIZEDROUTE_NOT_AUTHORIZEDWRONG_CHAINRPC_UNAVAILABLEOne call between receiving a 402 and signing the transfer. Your application stays in control of payment.
Reads the registry directly from Arc. No PayTLS server or database sits in the trust path.
const result = await paytls.verifyPaymentRequest({
url, paymentAddress: quote.payTo,
});
if (!result.valid) return refuse(result.reason);The same rules over HTTP, for quick checks, dashboards and languages without the SDK.
GET /api/v1/verify
?domain=api.example.com
&payTo=0x71C4…82F1An immutable registry on Arc mainnet with no proxy and no admin. Issue, replace and revoke; history stays public.
getCurrentCertificateId(domainHash)
isCertificateValid(certificateId)An example agent validates a signed quote, rechecks the registry, pays 0.01 USDC on Arc and redeems the receipt.
pnpm agentPayTLS can collect or withhold proofs. It cannot forge an authorization, and no admin can rewrite a certificate.
PayTLS does not prove that a service is honest, that its responses are correct, or that a domain keeps the same owner after issuance. It has not had an independent security audit yet.
Give your agent a reason to trust
Verify a Serviceor issue a certificate for your API