Verify a narrow signed receipt on your server

Loop

1. Select a policy pack in Partner Launchpad.
2. Redirect the holder to the hosted verification URL.
3. Receive callback keys only. They are not authorization.
4. Fetch GET /api/receipts/{id}/public and evaluate with AbraxasPartnerKit.
5. If a webhook arrives, verify the HMAC, ignore duplicates, then fetch the public receipt. Never grant access from the webhook body.

The Partner Integration Kit is source level code in this repository (lib/partner/integrationKit). It is not a published npm package.

Google sign in creates an Abraxas account. It does not prove age, identity, residency, or eligibility.

Public receipt verification is not a one time consume. A currently valid receipt can be fetched and evaluated again. Partner Flow evaluate has separate request idempotency. Do not treat public GET as replay protection.

Generic TypeScript

import { AbraxasPartnerKit, permitProtocolAction } from "@/lib/partner/integrationKit";

const kit = new AbraxasPartnerKit({
  partnerId: "your-partner-id",
  policyId: "your-policy-v1",
  policyVersion: 1,
  requirePolicyVersion: true,
  environment: "sandbox",
});

export async function startVerification(returnUrl: string) {
  return kit.createHostedVerificationUrl(returnUrl);
}

export async function completeVerification(callbackSearch: URLSearchParams) {
  const result = await kit.verifyCallback(callbackSearch);
  // Grant only when outcome is permitted.
  if (!permitProtocolAction(result)) {
    return { grant: false, outcome: result.outcome };
  }
  return { grant: true, outcome: "permitted" };
}

PARTNER_FLOW_RP_PARTNER_ID=your-protocol-partner \
PARTNER_FLOW_RP_POLICY_ID=your-protocol-policy-v1 \
PARTNER_FLOW_RP_RETURN_URL=https://your-app.example.com/auth/abraxas/callback \
PARTNER_FLOW_RP_BASE_URL=https://abraxasworld.xyz \
npm run partner:conformance

Studio: Integration Studio · Launchpad: Partner Launchpad · Solana: Solana integration · Venue: Trading venue · Profiles: Venue profiles · Keys: Receipt key lifecycle