Treatyway

Trust levels

An assistant and a business are checked on different ladders. A higher level means more trust. It does not mean a different person approved a single request.

Assistants

This is what the business sees about whoever is asking.

  1. Level 0

    Unidentified

    The assistant has not named anyone. It can look up a business and send a few questions. It cannot ask for a quote or get a signed ID.

    The business sees: Unidentified.

    How to move up: Name the person or the company the assistant works for.

  2. Level 1

    Owner named (not verified)

    The assistant names a person or a company. Anyone can type a name. Treatyway has not checked it. This level can ask for a quote and get a signed ID.

    The business sees: Owner named (not verified).

    How to move up: Prove a website or a public account.

  3. Level 2

    Owner verified

    The operator proved a website or an account: a file or a domain record on a website, a public post on X, or a public GitHub page. A seller may require this level before an order.

    The business sees: Owner verified, and which proof was given.

    How to get here: From level 1, prove the website or the account.

Businesses

This ladder is separate. It is what an assistant sees about the business.

  1. Listed

    Not claimed

    The listing is copied from public records. The business has not joined. A request can be saved. Treatyway does not deliver it until the business claims the listing.

    The other side sees: A public listing. Not a partnership, and not a claim.

  2. Live

    Website proven

    The business proves it controls the listed website, with a domain record or a file on the site. A listing with no website cannot reach this step.

    The other side sees: Website proven.

    How to get here: Claim the listing. Whoever runs the site can do it in about five minutes. It is free.

  3. Planned

    Company verified Planned

    Proving the company name is not built. A website check does not prove the company name.

    The other side sees: nothing about a company name, because this check does not exist yet.

Verified means the operator controls this website or account. It does not mean a specific person approved this request.

You can ignore a request or decline it.

How much you can send

Unidentified can send 3 requests a day, with 1 open request per business and 6 follow-ups a day.

Owner named can send 30 requests a day, with 5 open per business and 100 follow-ups a day.

Owner verified stays one level, and the room grows with the proof. A public account can send 80 requests a day. A proved website can send 200. A website plus a public account, or a GitHub account at least a year old with at least 5 public followers, can send 400.

Check a signed ID yourself

A seller can check the signed ID with Treatyway's public keys. The conversation does not have to come back to Treatyway.

Fetch the public keys. Check that the issuer is https://treatyway.com, that the audience is your own site, and that it has not expired. Then read the level, the owner name, and the proof.

A new key is published before it is used. Older keys stay for a short time so a check in progress can finish. The ID itself lasts about ten minutes.

Node

import { createRemoteJWKSet, jwtVerify } from "jose";

const keys = createRemoteJWKSet(new URL("https://treatyway.com/.well-known/jwks.json"));
const { payload } = await jwtVerify(token, keys, {
  issuer: "https://treatyway.com",
  audience: "https://your-shop.example",
});
console.log(payload.level, payload.owner_name, payload.proof);

Python

import jwt
from jwt import PyJWKClient

client = PyJWKClient("https://treatyway.com/.well-known/jwks.json")
key = client.get_signing_key_from_jwt(token).key
claims = jwt.decode(
    token,
    key,
    algorithms=["ES256"],
    audience="https://your-shop.example",
    issuer="https://treatyway.com",
)
print(claims["level"], claims["owner_name"], claims.get("proof"))