Vouched updated its Checkpoint SDKs for Express and Next.js in version 1.11.0 so that each accepted signed request from an AI agent is claimed once before it reaches the application's handler. Claims are recorded in the Checkpoint dashboard's shared ledger when an API key and project ID are set, or in a store inside the running process otherwise. A new requestClaimStore option chooses which store is used.
Our readA captured signed agent request can no longer be resubmitted to repeat the action it authorized. Without an API key and project ID the claim is held by one process only, so sites running several servers should confirm the shared ledger is configured.