Private Pay

Private Pay pays a merchant from a disposable address created for that one payment. The account stores no payer identity, so the merchant paid from it cannot read who funded it from the account itself. Every spend is authorized by an enclave co-signer (“The Machine”) that vetoes a drainer, a lookalike, or an over-policy spend. A veto is not a warning; it withholds the signature, so the payment is impossible. You sign nothing blind. A spend needs only the co-signer’s signature, because the funds are hard-locked to the pre-set target and cap: the co-signer can only push the exact payment you set up, never steal or redirect. Your sole on-chain action is a normal, readable USDC transfer to fund the account.

Full payer privacy is not delivered today. The funding transfer (your wallet to the ephemeral account) is a normal transfer on a transparent chain, so an observer can still trace you to the ephemeral address through it. Hiding that link and the amounts requires Arc Privacy Sector confidential transfers, which are on the roadmap and not live yet. What is delivered now: the account surface reveals nothing about you.

The flow

The Machine checks first

Pre-flight the firewall on the intended merchant, before anything is created. A veto here means nothing is deployed and no funds ever move.

import { RemoteCoSigner } from '@ctrl-arcz/sdk';
import { parseUnits, toHex } from 'viem';

const amount = parseUnits('0.02', 6);
const salt = toHex(crypto.getRandomValues(new Uint8Array(32))); // the user salt
const expiry = Math.floor(Date.now() / 1000) + 900; // 15 minutes

// The co-signer's public address (served by your backend, see below).
const { address: cosignerAddress } = await fetch('/api/cosign').then((r) => r.json());

const cosigner = new RemoteCoSigner('/api/cosign', cosignerAddress);
const pre = await cosigner.precheck({ owner, target: merchant, amount });

if (!pre.approved) {
  // The Machine vetoed it. Nothing was created.
  console.warn('Vetoed:', pre.reason, pre.riskReasons);
  return;
}

precheck runs before the address is even derived, because the derivation commits to the policy: a box’s address is a hash of the owner, the salt and every policy field. There is nothing to predict until the target is settled, and nothing worth predicting for a target The Machine will refuse.

Create the disposable address

import {
  createEphemeral,
  predictEphemeral,
  MODE_PUSH,
  ADDRESSES,
  SPEND_POLICY_FACTORY_ADDRESS,
} from '@ctrl-arcz/sdk';

const policy = {
  token: ADDRESSES.USDC,
  owner,
  cosigner: cosignerAddress,
  vault: owner,       // sweeps return here, and only this address may trigger one
  target: merchant,   // the address is locked to this merchant on-chain
  maxAmount: amount,  // cumulative cap, enforced on-chain
  expiry,
  interval: 0,
  mode: MODE_PUSH,
};

// Optional: the address exists as a prediction before it exists on chain.
const account = await predictEphemeral(
  publicClient,
  SPEND_POLICY_FACTORY_ADDRESS,
  salt,
  policy,
);

await createEphemeral(clients, SPEND_POLICY_FACTORY_ADDRESS, salt, policy);

The account is a minimal-proxy clone at a deterministic address. Its CREATE2 salt commits to ownerHash, your salt and a hash of every policy field, so the address is bound to the policy rather than to your address or to msg.sender: it can be funded before it exists, nobody can front-run its slot, and a different target or cap is simply a different address. Anyone may submit createEphemeral, so an integrator can deploy through a relayer to keep you off the deployment transaction entirely.

Fund it

Move USDC into the disposable address. In production this leg is confidential (Arc Privacy Sector); today it is a plain transfer.

import { fundEphemeral } from '@ctrl-arcz/sdk';

await fundEphemeral(clients, account, amount, policy);

fundEphemeral re-reads the deployed policy and compares every field before it transfers, then throws rather than paying into a box that does not match. Use it instead of a bare ERC-20 transfer: a transfer to an address that already exists always succeeds, so the direct path skips the check silently.On Arc a USDC ERC-20 transfer moves native balance, so the account and vault implement receive(). The deployed contracts handle that.

Pay

Read the account’s on-chain policy, ask the co-signer to authorize the spend, then submit its signature alone. You sign nothing here. The funds can only reach the locked target, so anyone may submit the transaction.

import { readAccount, submitPay, ACTION_PAY } from '@ctrl-arcz/sdk';

const state = await readAccount(publicClient, account);
const chainId = await publicClient.getChainId();

// The server re-reads the real policy from chain; a RemoteCoSigner forwards only
// { account, owner, amount, action } and ignores what the browser claims.
const auth = await cosigner.authorize({
  account, owner, amount, action: ACTION_PAY,
  target: state.target, nonce: state.nonce, chainId,
  remaining: state.remaining, expiry: state.expiry,
});
if (!auth.approved) {
  console.warn('Vetoed:', auth.reason, auth.riskReasons);
  return;
}

const txHash = await submitPay(clients, account, amount, auth.signature);

The merchant receives USDC from a zero-history address. The account itself reveals nothing about you.

One call

For a straightforward push payment you can skip the manual steps with settlePrivatePayment, which reads the account, runs the co-signer, signs and submits:

import { settlePrivatePayment } from '@ctrl-arcz/sdk';

const outcome = await settlePrivatePayment(clients, account, amount, cosigner, {
  owner,
});
if (!outcome.ok) console.warn('Vetoed:', outcome.reason);
else console.log('Paid:', outcome.result.txHash);

Recovery and refunds

The disposable address is a one-way valve: funds can only go to the locked merchant or back to your vault. Both sweeps require msg.sender == vault and that the address match the account’s stored vaultHash. No signature is involved, and the vault stays hidden until it sweeps. Because the vault has to send the transaction, bind the box to an address you can transact from: above, that is the payer’s own wallet.

Enclave down / abandoned: after expiry, the vault calls sweepExpired(vault) and the balance comes home. No co-signer needed.
Refund: the merchant refunds to the disposable address; a sweep takes it home.
Cancel early: call sweepToVault(vault) any time.

import { sweepExpired, sweepToVault } from '@ctrl-arcz/sdk';

// `clients.walletClient` must be signing as `vault` itself; passing the address is
// not enough. Here the vault is the payer's own wallet.
await sweepToVault(clients, account, owner); // any time
await sweepExpired(clients, account, owner); // only after expiry

Do not bind a box to a contract that cannot call it back. SHIELD_VAULT_ADDRESS is the demo Vault, which funds accounts but has no function that calls sweepToVault on one, so a box bound to it can never be swept. Use it as a funding source, and bind the return address to a wallet.

Run the guard server-side: The co-signer.
Understand the model: Payer-side shield.

Get started

Integrate the SDK

Concepts

Reference

Clients

The flow

One call

Recovery and refunds

Next

​The flow

​One call

​Recovery and refunds

​Next

The flow

One call

Recovery and refunds

Next