Specification, not yet live. See Shadow Protocol.
The proposed flow gives the payer full payment details and observers a more limited view. The proposed flow gives the payer full payment details and observers a more limited view.

​
Two views of the same payment

Observer on-chain

The user

​
Best practices for integrators

1

Never expose private keys

Load keys from the environment (process.env.PRIVATE_KEY), never from source code or the browser.
2

Verify on the backend

Check every payment token server-side with numpay.verifyPaymentToken(token). Never trust a client-side “paid” flag.
3

Prevent replays

Store used payment tokens and reject any token seen before.
4

Rate-limit proof generation

Proofs are expensive. Enforce a gap (for example 10 seconds) between proof generations on the client.