dev.uqp.quoting.quote_lock extension uses version 2026-11-05. Discover verification keys at https://api.quote.dev/.well-known/jwks.json. The signed quote_hash binds the returned locked_quote snapshot.
Verify the signature with the identified key, recompute the snapshot hash, check quote identity and expiration, and compare integer amounts and currency before trusting a lock. A signature is not proof of payment capture. Sandbox locks use a public fixture key and must never be trusted as live credentials.
Verify agent webhook X-QuoteDev-Signature with HMAC-SHA256 over the raw request bytes before parsing or applying provider decisions. Keep signing secrets server-side. Quote locks describe the Layer-2 quote.dev contract; the upstream UQP protocol is external Apache-2.0 infrastructure.
Quote lifecycle · API reference