VouchAgent
The browser Vouch uses to pay at online stores on behalf of an identity-verified person who approved that exact purchase. It is run by HitPay Payment Solutions Pte Ltd, Singapore.
What it does
A person's AI assistant asks Vouch to buy something. Vouch verifies the person's identity once (government ID and selfie), shows them the merchant, the order and the exact total on a page where they sign in and approve, and only then opens the store in its own browser, adds the item, fills the delivery details the person saved, and pays with a single-use card issued for that amount at that merchant. One store, one order, one session at a time; no crawling, no indexing, nothing is stored from the pages it visits beyond the outcome of the purchase.
How it identifies itself
- User-Agent: Chrome's own string followed by
VouchAgent/1.0 (+https://vouch.hitpay.dev/.well-known/vouch-agent.json). - Web Bot Auth (IETF draft-meunier-webbotauth-httpsig-protocol): every request carries
Signature,Signature-InputandSignature-Agent "https://vouch.hitpay.dev", signed with the Ed25519 key published in the signed directory at https://vouch.hitpay.dev/.well-known/http-message-signatures-directory. - X-Vouch-Agent: a signed token naming the purchase (merchant, exact amount, that the buyer is verified); keys at https://vouch.hitpay.dev/.well-known/jwks.json, or
POST https://vouch.hitpay.dev/api/v1/agent/verify. - TAC-Protocol: Forter's Trusted Agentic Commerce Protocol message, for risk engines that read it.
Machine-readable descriptor: https://vouch.hitpay.dev/.well-known/vouch-agent.json.
How to keep it out
Add a group for it to your robots.txt. Vouch reads the rules written for its own name before it opens a store, and does not walk a store that disallows it. It does not apply the * group, which is meant for crawlers; Vouch fetches only what one person asked it to buy.
User-agent: VouchAgent Disallow: /
Rate and behaviour
A purchase is a few dozen page loads over one to three minutes, from one browser, with no parallel sessions against the same store. Vouch does not bypass bot checks, CAPTCHAs or sign-in walls: it stops and hands the page back to the person.