HypertronDocs
What Hypertron isPrivacy protocolMerchant paymentsWhat the platform isSurfacesAcceptTreasuryDiscloseKYB and allowlistWhat it is notPayments APIDeveloper tooling

Merchant payments

Operate the pool without becoming the prover.

A business should be able to add private stablecoin payments without understanding circuits, proving systems, or Soroban internals. The workspace is that layer: payment links, hosted checkout, private settlement, treasury activity, and payment monitoring. Every payment still lands in the same Merkle tree described in the protocol docs.

Open workspaceProtocol spec

Control plane

One workspace, five surfaces.

Authentication is a Freighter-signed challenge against the core backend. The session cookie authorizes dashboard routes. It is not a spend key and cannot move notes.

TabJob
OverviewWorkspace status: open requests, recent settlement, shielded vs liquid balance.
PaymentsCreate links, send privately from owned notes, track hosted checkout.
TreasuryShielded notes, unshield to a public address, denomination top-up.
DevelopersAPI keys and webhook endpoints for the Payments API (same workspace).
SettingsProfile, receive address, viewing-key export for an auditor.

Accept

Payment links and hosted checkout.

A link is an internal checkout object. The customer-facing URL is /pay/{id}. Privacy-on checkout spends owned notes via transfer or transfer_n. Privacy-off is a classic Stellar payment with an hpl_ memo.

  • Note selection is {1, 2, 4} to match live VK ids 3, 4, and 5. Three-note covers need a fourth owned note or a top-up.
  • If owned notes do not cover the amount, checkout still has a transparent deposit fallback. That path puts amount on the explorer. Treat confidential checkout as incomplete until that fallback is gone.
  • Note secrets for a private deposit live in browser localStorage keyed by the link. They are never sent to Nest.

Treasury

Shielded balance is a note set, not an account.

The workspace lists confirmed unspent notes with leaf indices. Unshield is still the 1-in circuit (VK 2): one note out to a public recipient, change retained by the wallet. TransferN consolidation exists in the pool; the withdraw UI is not yet wired to it.

Selective disclosure

Export a viewing secret. Never a spend key.

An auditor with the viewing secret can decrypt blobs encrypted to that key, recompute commitments, and match on-chain leaves. They cannot derive nullifiers or spend. This is read-only disclosure, not invoice-bound ZK receipts.

Current export is auditor-grade viewing material, not bookkeeper-grade reconciliation and not a proof that invoice X settled for amount Y without revealing the pool. Invoice-bound viewing receipts (a third party verifies one payment, confirms the export contains no spend key) are the next disclosure product. They are not in the protocol yet.

Production policy

KYB before private checkout. Allowlist, not open entry.

The current testnet pool is open for protocol testing. Production merchant participation is explicitly approved. Privacy inside the pool does not mean anonymous onboarding at the edge.

  • KYB verification completes before a merchant is enabled for private checkout. Applicable sanctions screening runs on merchant and public transaction addresses. Offboarding revokes checkout and allowlist membership; it cannot freeze notes already in the pool.
  • Production uses allowlist mode so addresses are approved rather than permitted by default. The live testnet pool has no policy attached (compliance: null). Entry checks on deposit are not shipped; today the hook is unshield-only.
  • Hypertron will not store identity documents. Provider, decision, reference ID, approver, and timestamp are retained. Documents stay with the KYB provider. Compliance information is separate from spending authority.

Boundary

The workspace is not the trusted core.

Dashboard, payment-link APIs, and viewing-key export can fail or lie without minting a note. Validity is Groth16 verification plus the commitment and nullifier contracts. Hypertron is not a mixer.

In the platformNot in the platform
Payment links, checkout, treasury UI, webhook configCircuit definitions, VK administration, Merkle insert authority
Freighter session cookie (ht_dashboard)spend_sk, proving keys, ceremony transcripts
Viewing-key auditor exportInvoice-bound ZK receipts (upcoming), SEP-6 / SEP-24 fiat ramps
KYB decision metadata (provider, result, reference)Identity documents, in-circuit sanctions checks, seizing notes in the pool
Privacy protocol →Payments API →Developer tooling →