Whitepaper

00 — Abstract

Abstract

Value transfer, viewed narrowly, is a solved problem. Instant rails settle in seconds, stablecoins settle in blocks, mobile money reaches people no bank branch ever will. What breaks is everything around the movement: knowing who someone is, where to send them, what they accept, what is owed, who is allowed to act, and whether it arrived. Every one of those questions crosses an organisational boundary. Every one of them is rebuilt, incompatibly, by each operator.

PATH standardises that last mile, and nothing else. It does not move money, hold funds, issue a token, verify identities, or price a transaction. It specifies the objects that two organisations have to agree on if those organisations are not the same company.

The load-bearing split is this. Formats are open: anyone may implement them without asking permission. Directories are closed: being findable by strangers means publishing a resolvable pointer to a customer base, and no regulated institution does that without reciprocity, contract and audit. Both have been true at once in the card industry for forty years. PATH applies the same split to the last mile.

This document is v0.1. Formats may still change. The changelog is the record of that, not a promise of stability. Nothing in it describes identifier hashing as zero knowledge. With a server-side pepper it is not.

01 — The last mile

The last mile

Before a single unit of value moves, a payer's application has to establish six facts. None of them is "did the rail settle". All of them are currently private dialects.

A recipient is reachable only inside one system. An identifier belongs to the institution, not the person. A payment request cannot leave its origin. A receipt is only as good as the relationship that produced it. Delegation is all or nothing. Those are not product gaps. They are the cost of treating the last mile as a private integration problem.

Why the usual fixes do not hold

PATH separates the two things that keep getting conflated. Formats are public. Directories belong to networks. A member joins one club rather than integrating fifty peers. An implementer who joins nothing can still speak the protocol with anyone who will speak it back.

02 — What PATH is not

What PATH is not

Restraint is not modesty. A protocol that also specified how to run a payment company would be implemented by nobody, because it would need renegotiating in every jurisdiction it touched.

PATH standardises what crosses a boundary between two organisations. Nothing else.

Run that line against a payment request and the split is unambiguous. The reference, the amount, the expiry, the disclosed fee, the signature and the receipt are in the protocol. The title, the image, the basket, the tax, the landing page and the provider integration are not. The right-hand column is where products differ. The left-hand column is where they have to agree, or nothing interoperates.

03 — Architecture

Architecture

Five pillars, each answering one question. The questions do not overlap. Four start from the payer. One starts from the receiver — and that one is the part a buyer actually sees.

An address carries a policy: I accept this asset on this rail, up to this much. A payment request carries a claim: you owe me this amount, for this order, until Friday. Those are different speech acts. A system that stores them in the same place ends up unable to expire one, revoke the other, or tell a payer which is which.

Transverse layers

PATH INTEROP carries the envelope. The pillar owns the object.

Two rows repay attention. pay points at a destination while request carries a claim — they look alike in a QR code and behave differently everywhere else. subscribe looks like a payment link but creates a standing permission, which is why it belongs to CONNECT. File it under REQUEST and you will ship without revocation or counters and discover it in production.

Status labels

RESERVED does not mean we forgot. It means a field exists in the format, is documented, and is never populated in this version. When it is finally specified, existing implementations gain a capability instead of breaking. PATH LIQUIDITY is the example: the route field sits on every settlement receipt and stays empty.

04 — Three rings

Three rings

Ring 1 is the protocol. Identity, addressing, standing intent, requests, authorisation objects, receipts, the interop URI, signatures, error codes. Implementing any of it requires access to nobody's data. You can do it alone, and nobody can stop you.

Ring 2 is a club, and has to be. There is exactly one capability in PATH where the shared resource is not a format but other people's customers: the directory. Entering it means publishing a resolvable pointer to your customer base. No regulated institution does that without reciprocity, a contract, an audit right, and the ability to exclude whoever abuses it.

Ring 3 never leaves the operator. Customer records, KYC documents, wallets, keys. Not in the protocol, not in a network, not in any circumstance.

Closing the directory replaces expensive cryptography with cheap governance. Querying a peer without revealing the identifier, finding which operator holds a number, preventing scraping, knowing who to trust, deciding who pays when something goes wrong: a club with a rulebook can answer those. An open index cannot, except by inventing cryptography that excludes the members who most need to join.

05 — Reachability

Reachability

Reaching someone is not one question. It is two, and they have different answerers. That is the page to read if you only read one.

The obvious simplification is to have the network answer both — one call, one round trip. It is also the one thing that would make the directory unacceptable to its own members. A network that answers step 1 learns who is being looked for. A network that also answers step 2 learns what that destination can receive: rails, assets, limits, and how those change. That is a competitor's product roadmap, arriving daily.

So the composition happens on the caller's side. The SDK makes both calls; the integrator writes one. The cost is a round trip. What it buys is that no single party sees both halves. A network may offer to relay step 2. If it does, it must say so in its discovery document rather than doing it silently.

The step you can skip

Two parties that already have a relationship resolve directly. They implement addressing, resolution, requests and receipts, and they join nothing. Every claim on this site about openness rests on that path existing and being documented.

Answers are signed, and constant-shaped

Both steps return signed envelopes. Keep them. Months later, when a payment went somewhere unexpected, the question is what you were told before you sent — and a signed answer turns that from one party's recollection into a document.

SONAR returns the same shape whether a key is unknown or known-but-not-visible to the caller. A route that distinguishes the two is an oracle: ask it enough times and it answers "is this person a customer of somebody", for any phone number you care to try. The same reasoning applies to timing and to status codes. A faster negative is still a signal.

06 — Networks

Networks

There will be more than one network, and the protocol expects them to interoperate. Open Connect is the first PATH network. It is not the protocol. A West African club, a European club, a private banking group: all speak ring 1. Each writes its own rulebook.

A network may not answer on behalf of its members about what they accept. A directory that did would hold its members' capability data — ring 3 material sitting in ring 2 — and no second member would sign that.

Two directory topologies

Broadcast is workable with declared coverage — a Senegalese number only reaches members serving Senegal. Designs where the caller searches locally (a published feed, k-anonymity buckets, Bloom filters) all founder on the same rock: to test a candidate against a list of hashes you must be able to compute the hash, which means holding the pepper. Distributing it is refused.

Discoverability belongs to the entry

A merchant wants to be publicly findable. A private individual never is by default. Even where the key is public — a company register number is public by construction — the answer is not. "This company banks with that member" is commercial information. A public entry opens the key, not the budget.

07 — Privacy

Privacy

Most privacy failures in payment systems come from collapsing authentication, identifiers and consent into one record. PATH keeps them apart. A disclosure requires all three.

Identifiers are normalised, then hashed with a network-held secret — a pepper — using Argon2id. The directory stores hashes; it never stores the identifier.

The hash protects the database, not members from the network.

A stolen dump is not a phone book. Reversing it requires the pepper, which is not in the dump. That is what hashing buys. What it does not buy: hiding identifiers from the operator that computes the hash. The pepper is server-side. A member sends the identifier in the clear. The operator sees it in order to hash it. There is no way around that in this configuration. Calling it zero knowledge would be false.

Until that construction ships, the finder block of a discovery document must say hashing is server_side. A prospective member has a right to know, and to refuse.

08 — Trust and signatures

Trust and signatures

Anything a counterparty may quote back is signed.

Resolver answers, directory answers, payment requests, settlement receipts, holder confirmations, attestations. If a statement might matter later, it carries a signature. TLS proves you talked to the right server. It says nothing about the statement that server handed you, and it leaves nothing behind.

Signatures are Ed25519. Not an HMAC. A shared secret proves that someone holding the secret produced the value — and the recipient holds it too, so the recipient could have produced it. That is fine for a session cookie and useless for a statement a third party has to rely on.

Everything signed is serialised as RFC 8785 canonical JSON before signing: keys sorted, no insignificant whitespace, undefined dropped, numbers in shortest round-trip form. JSON.stringify preserves insertion order. Two implementations produce different bytes for the same object, therefore different signatures, and neither can verify the other. It works in testing — one implementation talking to itself — and fails the day a second one appears.

09 — Discovery and conformance

Discovery and conformance

An operator publishes a discovery document at /.well-known/path-configuration. Unauthenticated, always. Anyone considering an integration has to read it before there is a relationship to authenticate. A discovery document behind a key is a brochure.

Declaring is committing. A profile announced and not honoured is a non-conformity, not an approximation. The finder block is the material part for a prospective member: sonar mode, hashing, who may query, the reciprocity budget, how long searches are kept. Those answers change whether an institution can join, and they belong in public rather than in a contract annex.

The published register of networks is a small public list of clubs, not an admission desk. PATH lists them. Each network decides who sits in it.

10 — Security

Security

The realistic directory attacker is not an anonymous outsider. It is an authenticated participant, or someone holding their key.

Mistakes that cause incidents

1. 01Unanchored URI parsing. Scan a payload for a pattern anywhere and a crafted suffix steals the payment. Anchor at both ends. Match the whole string.
2. 02Symmetric signatures on public statements. An HMAC the recipient could have forged proves nothing to a third party.
3. 03Non-canonical serialisation. One implementation talking to itself hides the bug until a second language appears.
4. 04Returning a profile from a lookup. A routing answer that includes a name is a disclosure.
5. 05Looking up an address book on install. The reciprocity budget exists because this is the default instinct, and it is the wrong one.

Security issues in the specification or the reference implementation go to security@pathprotocol.dev. Issues in a specific operator's deployment go to that operator — its contact is in its discovery document.

11 — Status of this document

Status of this document

PATH 0.1.0 is a draft. The formats may still change. Each change is recorded in the changelog with what it breaks and what to do about it. Protocol versions and API versions move independently: the first changes the objects, the second changes this implementation's HTTP surface.

Out of scope for v0.1, and declared so: liquidity routing; any settlement token; selective disclosure over attestations; the full checkout lifecycle (partial payments, multiple attempts, refunds tied to an order). The hand-back is specified. The rest waits. A specification that covers three things well beats one that announces five and delivers one.

The reference implementation, the TypeScript SDK, and two MCP servers are published in the same repository as this paper. They are a way to contradict the specification, not a product. Open Connect is the first network to speak it. Other networks will. They will not be PATH, and PATH will not be them.

The protocol is open. A directory is a club.