Check register / Payment

PAY-026

A requirement the spck.dev suite checks on UCP servers. The quoted text is the normative requirement; the citation links to the exact line of the pinned spec source it was taken from.

2026-01-11:

All AP2 signatures must use one of the approved algorithms (ES256/ES384/ES512).

2026-01-23:

All AP2 signatures must use one of the approved algorithms (ES256/ES384/ES512).

2026-04-08:

A token binding MUST include the checkout_id the token is bound to (prevents token reuse across checkouts/participants)

Keyword

MUST

Area

Payment

Versions

2026-01-11 2026-01-23 2026-04-08

Testability

needs a receiver the suite controls, so it runs in the CLI/full suite

Spec source

ucp:docs/specification/ap2-mandates.md#L130 2026-01-11

ucp:docs/specification/ap2-mandates.md#L130 2026-01-23

ucp:source/schemas/shopping/types/binding.json#L7 2026-04-08

How this is graded

A deviation on a MUST fails the run and shows the requirement next to the actual response. Checks the suite cannot validate soundly are reported inconclusive or not-tested — never a silent pass. The full verdict semantics are on the grading rubric.

Run it against your store

The hosted check covers the read-only surface; the CLI and GitHub Action run the full suite, including this check when your store declares the capability it belongs to.