Skip to main content

Glossary

A quick reference for terms used across this section. Each entry links to where it's covered in depth.

Agent-edge​

The authenticated outbound connection your disbursement agent uses to reach the platform: it settles proved batches and can vend short-lived credentials over /agent-edge/bootstrap. See Authentication → Pool-gate OAuth and Disbursement → Configuring the agent.

Batch​

A slice of a disbursement settled in a single on-chain fund() transaction. Large disbursement runs are split across several batches, each with its own status. See Disbursement.

Blacklist​

The pool-gate's list of wallet public keys excluded from the pool. Enforced entirely in-circuit: the prover proves non-membership per recipient. There is no production write path exposed to integrators. See Eligibility → Blacklist.

Capability​

What a single API key is scoped to: disburse, holder.read, holder.transfer, or holder.send. A key minted for one cannot reach the routes another needs, even if both are held by the same wallet. See Account Operations → Minting a scoped credential.

Disbursement agent​

The process you run on your own infrastructure that holds your prover and, by default, no private keys; it exposes /api/disburse and talks to the platform only over the agent-edge. See Overview → Core concepts.

Dual signature​

What every on-chain fund() call requires: the platform's own relayer signature plus the Funding Party's funder authorization signature, produced by whichever FunderSigner is configured. See Disbursement.

Encryption public key (P)​

The public half of a viewing key, distinct from W: what the relayer seals note ciphertext to, and what a holder needs the private half of to decrypt their own notes. Usually derived from a signature over a fixed message, which requires that signature to be reproducible; a wallet in MPC custody must use a key generated and escrowed by its owner instead. P differs per curve, so it is enrolled per chain family. Whoever holds the private half can read that subject's balance and history, and cannot move its funds. See Account Operations → The viewing key.

Funder wallet​

The wallet the Funding Party controls: it holds the token balance being disbursed and is the identity every funder authorization signature is issued from.

FunderSigner​

The pluggable abstraction that produces the funder's authorization signature: a local private key, a signing enclave, Fireblocks, or DFNS. Never a browser wallet popup. See Disbursement → Configuring the agent.

Funding Party​

The account owner: controls the funder wallet and authorizes every disbursement. Some literal API paths still say "employer" for historical reasons; same role. See Overview → Core concepts.

Idempotency key​

The caller-supplied string (Idempotency-Key header) that deduplicates a POST /api/disburse call: replaying the same key with the same body returns the original job instead of double-disbursing. See Disbursement.

Note commitment​

An opaque on-chain value that cryptographically binds a recipient's wallet public key, an amount, and random nonces. Only the commitment is published; none of its inputs are recoverable from it. See Overview → Core concepts.

Partial finality​

The disbursement job state (status: "partial") when some batches confirmed on-chain before a later one failed. Never surfaced as a bare failure, since earlier batches already moved funds. See Disbursement.

Pool-gate​

The standalone eligibility service holding the whitelist and blacklist. Issues the signed eligibility material a disbursement proof needs as private inputs. See Eligibility.

Pool subject​

An account that can hold and spend a pool balance: a (W, P) pair, enrolled and whitelisted. Recipients become subjects automatically at first login; a Funding Party's own wallet has to enroll explicitly. See Account Operations → Becoming a pool subject.

Recipient​

A wallet address receiving funds in a disbursement. Identified to the API by address; identified to the pool-gate and the circuit by wallet public key.

Send (external send)​

The operation that moves value out of the pool to a chain address, either back to the holder's own wallet or to a destination pinned in the agent's configuration. Never accepts a caller-supplied address. See Account Operations → Withdraw.

SIWX session​

"Sign-in with X": a wallet-signature login that authenticates a human driving admin actions (onboarding, eligibility resync). Never used for the disbursement call itself. See Authentication → SIWX session.

Transfer​

The operation that moves value between two pool subjects without either leaving the pool. Guarded the same as external send: it can move a holder's entire balance, just not to an address outside the pool in one step. See Account Operations → Transfer.

Wallet public key (W)​

The secp256k1 affine x‖y (128 lowercase hex characters, no 0x prefix) that identifies a participant to the ZK circuit and the pool-gate. Not the same as a wallet's on-chain address. See Overview → Core concepts.

Whitelist​

The pool-gate's list of wallet public keys eligible to participate in the pool. Written automatically at a recipient's first SIWX login; repairable in bulk via the resync endpoint. See Eligibility → Whitelist.