Agent signer

@sohopay/agent-signer is the client library for the agent’s Ed25519 key. It does not call MCP, and it does not hold a borrower key. Policy and settlement stay on the server.

npm install @sohopay/agent-signer

import {
  generateWorkloadKey,
  signPoP,
  signVoucher,
  buildPaymentSignatureHeader,
} from "@sohopay/agent-signer";

const key = generateWorkloadKey();

const { pop_signature } = signPoP(
  {
    borrowerId,
    terminalId,
    jkt: key.jkt,
    nonce,
    iat: Math.floor(Date.now() / 1000),
  },
  key.privateKeyBase64Url,
);

const { signature } = signVoucher({
  voucher,
  signing,
  privateKeyBase64Url: key.privateKeyBase64Url,
  publicJwk: key.publicJwk,
});

const { headerName, headerValue } = buildPaymentSignatureHeader(
  prepareResponse,
  signature,
);

generateWorkloadKey runs once per terminal. Persist the private key on the host and register the public key with register_agent_workload_key. signVoucher checks the payment id and the key thumbprint, and it rejects a JWK that includes private material (d). Failures throw SignerError with a stable code. Pass the signing block from the prepare response through unchanged. The library will not sign under a scheme outside its allowlist. headerName is PAYMENT-SIGNATURE. Send headerValue on the retry to the merchant.

There is no @sohopay/sdk REST client and no sohopay package on PyPI. Python hosts shell out to this library or port the same signing rules. Do not hand-roll the voucher bytes from an old doc.

SDKs

Tools

Next steps

Key management

Payment flow

​Next steps

Key management

Payment flow

Next steps