How It Works#

1. Create — Agent A calls POST /payment-check/create. The TEE derives a unique ephemeral key, transfers tokens from the wallet to the ephemeral account via solver relay (gasless), and returns a check_key.
2. Share — Agent A sends the check_key to Agent B over any channel (API call, message, QR code). The key is a 64-char hex string — compact and easy to transmit.
3. Claim — Agent B calls POST /payment-check/claim with the key. The coordinator signs a transfer intent from the ephemeral account to Agent B's wallet and submits it via solver relay. Agent B receives the tokens gaslessly.
4. Reclaim (optional) — Agent A can reclaim any unclaimed funds at any time. The TEE re-derives the ephemeral key (no need to store it) and signs a transfer back to Agent A.

Transfer Mechanism#

All payment check operations use the NEAR Intents solver relay — a gasless off-chain transfer protocol. Instead of submitting on-chain transactions (which require NEAR for gas), the coordinator signs NEP-413 messages and submits them to the solver relay, which executes the transfer on intents.near.

Key Derivation#

Ephemeral keys are derived deterministically inside the TEE using HMAC-SHA256 from the master secret. The derivation path includes the wallet ID and a monotonic counter, ensuring each check gets a unique, non-reusable key.

Derivation hierarchy:
  wallet:{id}:near                        <- main wallet key
  wallet:{id}:near:check:{counter}        <- ephemeral key per check

The check_key IS the raw ed25519 private key of the ephemeral account.
The ephemeral account ID = hex(public_key) on intents.near.

Because the derivation is deterministic, the sender never needs to store the ephemeral key. For reclaim, the TEE re-derives it from the same path. For claim, the receiver uses the check_key directly to sign the transfer intent.

Use Cases#

Quick Start#

All examples use the OutLayer API at https://api.outlayer.fastnear.com.

1. Create a check

curl -X POST https://api.outlayer.fastnear.com/wallet/v1/payment-check/create \
  -H "Authorization: Bearer wk_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1",
    "amount": "1000000",
    "memo": "Payment for data analysis",
    "expires_in": 3600
  }'

{
  "check_id": "a1b2c3d4-...",
  "check_key": "7f3a9b2c...64 hex chars...",
  "token": "17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1",
  "amount": "1000000",
  "memo": "Payment for data analysis",
  "created_at": "2026-03-13T10:00:00Z",
  "expires_at": "2026-03-13T11:00:00Z"
}

2. Share the check_key with the receiver

Send check_key to the other agent via any channel. The key is all they need to claim the funds.

3. Receiver claims the check

# Full claim (all funds)
curl -X POST https://api.outlayer.fastnear.com/wallet/v1/payment-check/claim \
  -H "Authorization: Bearer wk_RECEIVER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"check_key": "7f3a9b2c...64 hex chars..."}'

# Partial claim (specific amount)
curl -X POST https://api.outlayer.fastnear.com/wallet/v1/payment-check/claim \
  -H "Authorization: Bearer wk_RECEIVER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"check_key": "7f3a9b2c...", "amount": "500000"}'

{
  "token": "17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1",
  "amount_claimed": "500000",
  "remaining": "500000",
  "memo": "Payment for data analysis",
  "claimed_at": "2026-03-13T10:05:00Z",
  "intent_hash": "Bx7k..."
}

4. Sender reclaims unclaimed funds (optional)

curl -X POST https://api.outlayer.fastnear.com/wallet/v1/payment-check/reclaim \
  -H "Authorization: Bearer wk_SENDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"check_id": "a1b2c3d4-..."}'

{
  "token": "17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1",
  "amount_reclaimed": "500000",
  "remaining": "0",
  "reclaimed_at": "2026-03-13T10:10:00Z",
  "intent_hash": "Cx9m..."
}

API Reference#

Base URL: https://api.outlayer.fastnear.com/wallet/v1/payment-check. All endpoints require wallet API key authentication via Authorization: Bearer wk_... header.

Check Lifecycle#

                    create
                      |
                      v
                  [unclaimed]
                   /      \
          claim   /        \  reclaim
                 v          v
       [partially_claimed] [partially_reclaimed]
              |       \         /       |
       claim  |        \       /        | reclaim
              v         v     v         v
          [claimed]   (mixed)    [reclaimed]

Statuses:
  unclaimed           - funds locked, waiting to be claimed
  partially_claimed   - some funds claimed, rest available
  partially_reclaimed - some funds reclaimed by sender
  claimed             - all funds claimed by receiver
  reclaimed           - all funds reclaimed by sender

Security Model#

Comparison with Alternatives#