[ DISCLOSURE ]
Choose what someone
gets to see.
Viewing authority is separate from spending authority. Every option below is read-only — none of them can move funds — but they differ enormously in how much they reveal.
What each one reveals
Stated in full, because a disclosure you did not understand is not consent.
Spend authority
You
Everything. This is your spending key.
Never share this. Nothing below can be turned back into it.
Audit view
An auditor you choose
Every note you hold or held, their amounts, when they appeared, and which ones you have already spent. Your whole position and history.
Spend, transfer or unshield anything.
This is the widest tier. It carries the key that detects spends, which cannot be rotated without rotating your spending key — so an audit view is effectively permanent.
Receive view
A counterparty or accountant tracking payments to you
Every payment sent to you, the amounts, and when they arrived.
See your change notes, your balance, or your spending. And it cannot spend.
Its total is what you were paid, not what you hold. Anything labelling it a balance is wrong.
Disclosure permit
Whoever needs one specific answer
Only the listed notes and fields, until the stated expiry.
Open anything outside its list. And it cannot spend.
The narrowest key-based option. Prefer it over a view when a view is more than the question needs.
Disclosure proof
Anyone asking a yes/no question
Only the answer — for example “balance ≥ X” — and the fact that you answered.
Read any note, learn any amount, or spend.
No key changes hands at all. This is the option to reach for first.
[ REVOCATION ]
Handing over a key
cannot be undone.
This is the part that is easiest to overstate, so it is written down plainly instead.
- A capability is bearer key material. Once someone has it, they can keep a copy.
- An expiry is honoured by a cooperating reader. It cannot stop someone who already copied the keys from reading the same data later.
- Scope, on the other hand, holds against a hostile holder: a receive view can never be widened into an audit view, because the key material for the rest is simply absent.
- The only true revocation is rotating your spending key, which is a migration rather than a key operation. It is not implemented.
- A disclosure proof avoids all of this by handing over no key at all — its expiry is checked inside the circuit.
Prefer the narrowest answer
If a question can be answered with a proof, answer it with a proof. If it needs a key, issue the smallest one that works, with an expiry. An audit view is the last resort, not the default.
Viewing Key module →