The user-agent says ChatGPT. Is that proof?
No. Anyone can send the header ChatGPT-User, Claude-User, or Perplexity-User. Proof is a signature that matches the key that operator published. If the signature fails, the order stays Unknown.
Omar’s fear is the opposite of Dana’s. He does not want a plugin that paints “AI fraud” on a real customer because a script copied a user-agent. Declared means “this is what they called themselves.” Signed means “the key checked out on this server.” Those are different stamps on purpose.
Google signs some Google-Agent requests as agent.bot.goog, and not every one of them. A signed request is named Google. An unsigned Google-Agent request is declared. A normal browser with no token is Human.
The check runs on the store. The checkout request is not sent to another company to be classified.