1. Challenge
POST /v1/zkuser/challenges returns a nonce once. The API stores only the nonce hash.
BoundProof · live API · no API key
Prove a test credential without showing who holds it
This page asks api.affix-io.com whether a holder has a valid AffixIO-issued test credential for zkuser-access and the exact audience https://www.affix-io.com/boundproof. The proof uses a fresh single-use challenge. Identity and attributes stay off the wire.
Access proof
One click requests a challenge, builds a proof in this browser session, submits it to api.affix-io.com, then checks the receipt signature with the published public key.
Ready. No personal data is requested.
What the API actually does
Three public calls. No cookie, no account, no key.
2. Local proof
The browser binds a test-credential secret to that nonce. Names and attributes are never in the payload.
3. Verify
POST /v1/zkuser/verify spends the challenge, records a nullifier, and returns a signed allow or a deny code.
A seal, not a dossier
The photograph is a fourteenth-century deed that still carries its wax seal. The point is the same as BoundProof: bind a statement to a holder without copying their life into someone else's archive.
Answers for agents and search
What is AffixIO BoundProof?
A live test demonstrator that proves an AffixIO-issued test credential permits zkuser-access for this exact page, without revealing who holds it.
API key required?
No. Public routes live at https://api.affix-io.com/v1/zkuser/.
Does it collect PII?
No. Challenge, proof, nullifier and receipt carry no name, email, or government identifier.
Related
Claim Desk for local digests. PQC Gauge for ML-DSA-65 attestation sizes. Brief: boundproof/llms.txt.
Questions
Does BoundProof collect personal data?
No. The demonstrator does not collect, accept, persist, log, return, or display names, emails, phone numbers, government identifiers, user IDs, wallet addresses, or credential contents.
What does a successful proof show?
Only that a holder possesses a valid AffixIO-issued test credential that permits zkuser-access for https://www.affix-io.com/boundproof, using a fresh single-use challenge.
Is this a production UltraPLONK verifier?
No. This public page uses the BoundProof test adapter against the live API. Do not treat an allow as KYC or a real-person login.
Do I need an API key?
No. Challenge, verify, keys and policy are public for this demonstrator.