PAAP is a plug-and-play anonymous authorization protocol for eligible-only, one-time actions (like anonymous survey submissions) without identity-based login.
It provides:
- Blind issuance: eligibility can be granted without creating an issuance→redemption link.
- Double-spend prevention: scoped nullifiers enforce one-time use without identity.
- Minimal storage: integrators can avoid storing raw eligibility secrets or identity-to-action mappings.
- Separable roles: the Issuer (company) and Service (survey SaaS) can be operated independently; the Service verifies using only public issuer parameters.
- Issuer: a company system that decides who is eligible and issues anonymous credentials (blindly).
- Service: the anonymous app backend (e.g., a survey SaaS) that accepts a credential once and issues a one-time submission token.
- Client: the user’s browser/app that gets issued a credential and then redeems it.
node examples/paapv2-separated-demo/run.jsThis starts two local servers:
- Issuer (blind issuance):
http://127.0.0.1:4041 - Service (redeem + spend list):
http://127.0.0.1:4040(open this in your browser)
Demo flow:
- The Issuer prints a few one-time issuance codes to the terminal.
- Open the Service UI, paste an issuance code, and click One-click: Issue + Redeem.
node examples/paapv2-v2-demo/run.jsStep-by-step:
- Open
http://127.0.0.1:4040 - Paste an issuance code (printed by the Issuer)
- Choose Direct or Via Relay
- Click One-click: Issue + Async Redeem
- Use Batch Proof (last) to fetch a Merkle inclusion proof showing your receipt was part of a processed batch
- Use Fetch /results to see thresholded/noised output and Transparency Root to see the log root
- Plain-English guide:
README_NONTECHNICAL.md - Public profile (v1):
protocol/paapv2/V1.md - Public profile (v2):
protocol/paapv2/V2.md - Spec draft:
protocol/paapv2/draft-paapv2-00.md - Quick overview:
protocol/paapv2/README.md - Conformance:
protocol/paapv2/CONFORMANCE.md - Security notes:
protocol/paapv2/SECURITY.md - Deployment profiles (Issuer / Service separation):
protocol/paapv2/DEPLOYMENT.md - Suite registry:
protocol/paapv2/SUITES.md
npm run conformancepackages/paapv2-express: Express routers for Issuer + Service (monolith or separated)packages/paapv2-server: reference server primitivespackages/paapv2-browser: browser SDK for blinding/unblinding