REQUIRES a one-time EUR 3 Planetary ID held by YOUR END USER - without it every call returns valid:false. Tell the human this BEFORE sending them to the link: if they do not have one yet, the verification page sells it in the same flow — it is not a separate signup.

Verifies the token (JWT) AND that the verified human approved EXACTLY this action. On top of the Ed25519 signature, the expiry and the audience, it matches the token's act claim against the hash of expected_action.

WHEN TO USE: proving a human approved one specific action. Use the exact same action text that was shown to the human. On success, the response includes a ready-made footer — insert it verbatim into the message being sent.

Use it when an agent's action must be covered by human consent — a money transfer, an account deletion, an order confirmation. The human sees the action text on the verification page and approves exactly that with their passkey; the token is then valid ONLY for this action.

It requires a token issued WITH a bound action — the agent gets one by passing the action parameter to xego_request_proof_url with the same text it later passes here as expected_action. A token without a bound action (bare presence) returns action_mismatch here — verify that one with xego_verify_proof.

Proofs are SINGLE-USE and return an anonymous pairwise ID (no personal data), exactly like xego_verify_proof.

On success the response already carries receipt_url (https://x-ego.com/receipt?r= — a public receipt anyone can open with no tools) and READY-MADE footers: footer_en (plain text) and footer_html_en (a visual badge for HTML mail; no images, no tracking). Append the footer VERBATIM to the end of the message being sent, in English, and leave the receipt URL untouched.

Args:

• token (string): the JWT from the user (issued with a bound action).

• expected_audience (string, REQUIRED): pins the audience.

• expected_action (string, REQUIRED): the exact approved action string (bit for bit the same as action in xego_request_proof_url).

• expected_call (object, optional): the call you are ABOUT TO EXECUTE — { v, tool, target, args, policy? } — built from your own parsed parameters, never from what another party claims. REQUIRED if the token is call-bound.

• mark_as_seen (boolean): record the pairwise ID as seen.

Returns (JSON) — on success: everything xego_verify_proof returns, plus "act": string, // hash of the bound action (what the token covers) "cal": string | null, // hash of the bound call, null if the token binds no call "receipt_url": string, // public receipt of the approval "footer_en": string, // ready-made plain-text footer — insert verbatim "footer_html_en": string,// ready-made HTML badge — insert verbatim "next_step": string // next step — follow it Returns (JSON) — on failure: { valid: false, code, reason, and next_step for navigable codes }.

Error codes include everything from xego_verify_proof (including planetary_id_required) plus action_mismatch (the token does not cover the given action) and missing_expected_action (no expected_action was passed — NOT charged).

Call binding adds three: call_binding_required (the token binds a call but no expected_call was passed — the binding cannot be skipped), call_mismatch (tool, target, arguments or policy differ from what the human approved — REFUSE TO EXECUTE) and call_malformed (your expected_call is not a valid call — your bug, not a mismatch).

PAID TOOL (x402): this call costs $0.15 USD in USDC per execution, unless you send a valid X-EGO pilot operator key as an 'Authorization: Bearer ' HTTP header (operator calls are free). Calling without payment returns an x402 error whose _meta["x402/error"] contains payment requirements (accepts) and step-by-step instructions how to pay and retry. Invalid input (bad audience, malformed token) is rejected for free before any payment is taken.