# The user-agent says ChatGPT. Is that proof?

No. Anyone can send the header ChatGPT-User, Claude-User, or Perplexity-User. Declared is self-reported: the user-agent names a published token and nothing was signed. Signed authenticates the request operator with Web Bot Auth, not buyer intent or payment. If the signature fails, the order stays Unknown.

## What each confidence means

- **Declared**: self-reported from the user-agent or checkout agent field. It says what the request called itself, not who paid or why.
- **Signed**: the operator’s published key checked out on this server. It authenticates who sent the request, not that a person asked to buy or that payment is valid.
- **Payment**: When the order moves to processing, completed, or on-hold, Stripe or PayPal may name the agent from gateway meta. That is gateway attribution, not proof of settlement. Strong gateway signals can update the stamp unless it was already signed. Stripe Link alone is weak evidence and never changes the stamp.

## What signed requires

The signature has to be readable, current, and tied to a key that operator publishes. An expired signature, a replayed one, or a key that does not match does not get the agent’s name. The order stays Unknown. With no signature at all, a published name is stamped declared. The check is an HTTP message signature, Ed25519 only, as in RFC 9421 (https://www.rfc-editor.org/rfc/rfc9421).

The check runs on the store. The checkout request is not sent to Agent Stamp to be classified.

Canonical page: https://getagentstamp.com/blog/signature-or-name