What's real here, and what isn't

Real

• The Second Key engine, API, executor and database: every decision on these pages is made by the same code an integrator would call.
• Every PayPal call: orders, authorizations, captures, voids and payouts are real requests to the PayPal sandbox, and every status shown is read back from PayPal.
• The AI analysis (Claude), on the text you see. Code checks that every quote it cites really appears in the source.
• The audit trail: hash-chained, and re-verified on the Protection Desk.
• AP2 mandate signing and verification, including the keys in your browser.
• The products in “Try it with real products”: Channel3 search results from real retailers, with real prices. Before deciding, Second Key re-fetches each product from Channel3 by ID. The agent's pick there is made by Claude Haiku, unless you make it buy a particular product.

Synthetic or simulated

• Rose, Sarah, “Danny”, the callers and the contractor. Their calls and messages are prepared transcripts.
• The trail-shoe pages and the agent's choices in the replayed cases (the poisoned page and the five AP2 runs), so each run is repeatable. Their products are labelled fixtures.
• Sarah's phone: a separate browser window that holds its own key. In production the request goes by text or email through a provider, and that channel keeps the two keys apart. Here both windows run on one computer, so the demo proves the API boundary, not channel security.
• Recipients: one sandbox account receives every payout.
• The checkout for real products: they are sold through a demo merchant on the PayPal sandbox, not by the retailer that lists them. Nothing real is bought.

How a transfer works here

A payment is platform-mediated: PayPal holds an authorization to the Second Key demo merchant, which is then voided or captured. On approval there are two separate PayPal steps, each confirmed: the capture, then a payout to the recipient. It is not a PayPal Friends & Family payment, and Second Key can't cancel arbitrary PayPal transfers.

What it can't do

• The AI can miss manipulation. That is why it can only add a pause: the rules and a person decide, and PayPal's record is the outcome.
• It protects payments made through platforms that build it in. It doesn't stop someone paying through another app, or splitting a payment below their threshold.
• It doesn't listen to calls. People choose to share a conversation; the rule they set in advance works without one.

Built on

PayPal Orders v2 and Payouts

Authorize to reserve, void to stop, capture and pay out to complete.

Claude (Anthropic)

Finds manipulation and instructions aimed at agents, with quoted evidence.

AG Grid and AG Studio

The Protection Desk's incident queue, and Insights with a read-only analyst.

Channel3

Product search for the agent, and independent product facts by ID, so a check never relies on what the agent saw.

Render

The web app, API, worker and Postgres this demo runs on.

Postman

A collection in the repository: the judge scenarios, with assertions on PayPal's own state, and the AP2 endpoints.