Every time your AI agent does something for a user, Kynver can record it. That record is called a receipt — a tamper-evident log of the interaction that proves the agent did what it said it did. Receipts are the foundation of your agent's trust score, the Verified badge requirement, and the transparency users see when your agent is connected to Kynver.
This article explains how receipts work under the hood. You do not need to understand all of this to use Kynver — the SDK handles the details — but knowing why it works this way helps explain what you are asking users to trust.
What Is a Receipt?
A receipt is a record created each time your agent completes an interaction. It contains: - A hash of what the user asked (the instruction) — this is a one-way fingerprint of the text, not the text itself. Kynver never sees the raw content of your user's messages. - A hash of what the agent produced (the output) — same approach. - An encrypted action payload — the task category, any action types performed, duration, and whether the interaction succeeded. This payload is encrypted with Kynver's public key so only Kynver can read the details. - Authorization token IDs (optional) — for high-stakes actions like payments or emails, these confirm the user gave explicit authorization before the action happened.
This design means Kynver can verify that an interaction occurred and how it went without reading what your users said or what your agent replied.
Two Ways Receipts Are Signed
All receipts are cryptographically signed to prove they came from your agent and have not been modified. There are two tiers:
Tier 1 — Kynver Manages the Signing (Default)
When your agent is registered, Kynver automatically generates an ed25519 signing keypair and stores the private key in a secure key management system (KMS). Every receipt your agent submits is signed by Kynver on your behalf. You do not need to generate or manage any keys. This is how every new agent works right away — just install the SDK and set your environment variables.
Tier 2 — You Control Your Own Key (Self-Sovereign)
After passing the ownership challenge, you can upgrade to self-sovereign signing. You generate your own ed25519 key, provide the public key to Kynver, and set your private key in your environment. From that point, receipts are signed by your SDK before submission — Kynver verifies using the public key you registered. Tier 2 is required for the Verified badge on agents handling high-stakes actions.
See Signing Keys: Managed vs Self-Sovereign signing keys for how to set this up.
How to Add Tracking to Your Agent
The shortest path is auto-instrumentation — add one line to your agent's entry file and the SDK tracks everything automatically.
For JavaScript and TypeScript agents, see Add Execution Tracking to Your Agent (JavaScript / TypeScript SDK) sdk javascript. For Python agents (LangChain, CrewAI, plain Python), see Add Execution Tracking to Your Agent (Python SDK) sdk python.
Authorization for High-Stakes Actions
For actions that have real-world impact — payments, sending emails, deleting data — you should capture explicit user authorization before the action happens. The SDK's captureAuthorization() method creates an auditable pre-authorization record. If Kynver's audit endpoint is unavailable when you call it, the method throws an error, which is intentional: you should block the action rather than proceed without an audit trail.
Include the returned token ID when you call reportExecution() to link the authorization record to the receipt.
User Connect
Users can optionally link their Kynver identity to your app. Once linked, their interactions with your agent are tied to their Kynver identity, giving them a transparent history of what your agent did on their behalf. This increases the trust weight of those verified interactions in your agent's trust score and gives users confidence that they can see and verify the agent's activity.
See Kynver User Connect user connect for how to add the connect flow to your app.
How Tracking Affects Your Trust Score
Every completed receipt contributes to your agent's trust score through the transaction success rate component (30% of the score). Receipts from the last 90 days count most heavily. Receipts that include authorization tokens for high-stakes actions carry additional weight. Receipts flagged as high-stakes actions without authorization tokens are reviewed.