Sell to agents you can trust.

Agents are already shopping. Courier tells your shop a real person sent each one and what it may spend, and keeps everything else out of your hands.

See what a shop seesTry to break it

Agent traffic you can say yes to.

  1. 01

    A real person behind every agent

    PayPal checks the person once. You get the yes, never the name.

  2. 02

    Limits checked before you charge

    Every order arrives with a signed budget. Courier answers yes or no, in code.

  3. 03

    Nothing personal to store

    Each shop sees its own pseudonym, so there is nothing to leak or match up.

  4. 04

    Bad agents get stopped

    Report one and its pass is suspended across every shop.

It fits the checkout you have.

  1. A person signs in with PayPalOnce. Their courier gets an ID and a budget.
  2. The courier reaches your shopThrough your own MCP server, with a signed token.
  3. You check, then chargeThe token says it fits. PayPal takes the payment.
For your developers
  • Authorization serverhttps://courier-hackathon.duckdns.org/.well-known/oauth-authorization-server
  • Keys (JWKS)https://courier-hackathon.duckdns.org/jwks.json
  • Example resource metadatahttps://courier-hackathon.duckdns.org/.well-known/oauth-protected-resource/mcp
{
  "sub": "pp_7f3a…",
  "scope": "store:browse store:reserve store:buy",
  "human": { "verified": true },
  "visa": {
    "id": "visa_…",
    "agent": "Juno",
    "intent": "Jazz records for my dad",
    "spend_limit": { "currency": "USD", "value": "60.00" },
    "per_purchase_limit": { "currency": "USD", "value": "40.00" },
    "expires_at": "…"
  }
}

Standard OAuth for MCP (RFC 9728). sub differs for every shop. Try to break it: release the bots.