-
-
Dashboard
-
Landing Features
-
Landing Page
-
Payment History
-
ZK passport
-
ZK Pay
-
Payer authentication
-
AI Verification
Inspiration
Every time we transact online, we are asked to prove something about ourselves. We upload identity documents, repeat verification checks, and share sensitive information with platforms that often need just one fact: whether we are eligible to proceed.
We asked ourselves: What if you could prove something about your identity without revealing your identity itself?
That question inspired ZK Pass. We wanted to bring zero-knowledge cryptography out of theory and into a practical payment experience, where users verify once, hold a reusable credential, and prove specific eligibility claims whenever they need to transact.
Our vision was simple: your identity should not have to be the price of making a payment.
What it does
ZK Pass is a privacy-preserving identity verification and payment authorization platform.
It brings together three core modules:
- ZK Verify AI: An AI-assisted KYC workflow combining Tesseract OCR, deterministic document checks, MediaPipe on-device liveness detection, and Gemini-powered guidance and evidence summaries. Final verification decisions remain with a human reviewer.
- ZK Passport: Once approved, users receive a reusable, issuer-signed credential bound to a secret held in their browser. It uses Poseidon commitments and BabyJubJub EdDSA signatures to establish authenticity.
- ZK Pay: Instead of sharing identity documents, users generate real Groth16 zero-knowledge proofs in their browser using Circom and snarkjs. The backend verifies issuer authenticity, holder binding, KYC approval, credential expiry, and payment-specific challenges before unlocking PayPal Sandbox checkout.
The circuit also supports age eligibility proofs, allowing a user to prove they meet an age threshold without revealing their date of birth.
Every payment gets its own cryptographic challenge and single-use nullifier, preventing proofs from being reused across transactions.
Beyond traditional checkout, ZK Pass explores Agentic Commerce: an AI shopping agent that discovers products through Channel3 and uses delegated ZK authorization for checkout.
How we built it
We built ZK Pass as a full-stack application with three interconnected layers:
Frontend
- Next.js 16 and React 19.
- Browser-side Groth16 proof generation using snarkjs.
- MediaPipe Face Landmarker for on-device liveness checks.
- PayPal JavaScript SDK for checkout.
Backend
- Python 3.11 and FastAPI.
- SQLAlchemy with SQLite/PostgreSQL support.
- Server-side credential validation, proof verification, payment authorization, and PayPal API integration.
Cryptographic layer
- Circom 2 for custom zero-knowledge circuits.
- Groth16 for proof generation and verification.
- Poseidon hashing for cryptographic commitments.
- BabyJubJub EdDSA for issuer-signed credentials.
We also integrated:
- PayPal Orders API v2, Vault and Payouts for payment workflows.
- Gemini 2.0 Flash / Ollama for AI-assisted verification.
- Tesseract OCR for document extraction.
- Channel3 API for real-time product discovery.
- AG Grid for compliance queues and cryptographic audit ledgers.
- Bryntum TaskBoard for visual KYC lifecycle management.
- APIMatic for an OpenAPI-based merchant developer experience.
- Render for cloud deployment infrastructure.
The result is not just a verification interface, but an end-to-end system connecting identity, cryptographic authorization, and payment execution.
Challenges we ran into
Our biggest challenge was making zero-knowledge proofs meaningful in an actual payment workflow.
Generating a valid proof was only the beginning. We needed to ensure that it represented an authentic issuer-approved credential, belonged to the correct holder, satisfied the required eligibility conditions, and was bound to the exact payment being authorized.
We addressed this through issuer signature verification, payment-specific challenges, expiry validation, single-use nullifiers, and revocation checks.
Another challenge was coordinating browser-side proof generation with backend verification and PayPal's payment lifecycle. A successful frontend interaction could never be sufficient to authorize a payment; the backend had to independently validate the proof before proceeding.
We also had to establish clear boundaries between AI and security-critical decisions. AI assists with guidance, OCR normalization, and evidence summaries, while deterministic checks and human review control verification outcomes.
Finally, integrating multiple sponsor technologies into one coherent experience required careful coordination between independent APIs, frontend components, and backend services.
Accomplishments that we're proud of
- Implemented real Groth16 zero-knowledge proofs, rather than simulated verification flags or frontend-only checks.
- Built a reusable credential system using Poseidon commitments and BabyJubJub EdDSA signatures.
- Connected cryptographic proof verification directly to PayPal Sandbox order creation and capture.
- Implemented payment binding and replay protection using single-use nullifiers.
- Built an interactive security testing suite demonstrating how altered, expired, replayed, and incorrectly bound proofs are rejected.
- Developed an AI-assisted KYC workflow with OCR, browser-based liveness checks, and human review.
- Integrated an AI shopping agent with Channel3 for agentic commerce.
- Built dedicated compliance dashboards using AG Grid and Bryntum.
- Created an OpenAPI 3.0 developer gateway with APIMatic integration.
Most importantly, we brought together cryptography, AI, and payment infrastructure into one working product rather than treating them as disconnected demonstrations.
What we learned
We learned that building a privacy-preserving system requires much more than implementing a cryptographic algorithm. The real engineering challenge lies in designing the complete trust boundary: what the user holds, what the issuer signs, what the verifier receives, and what the merchant is allowed to learn.
We gained hands-on experience integrating Groth16 proofs into a full-stack application, designing payment-bound authorization, handling replay attacks, coordinating multiple external APIs, and connecting AI-assisted workflows with deterministic security checks.
We also learned an important product lesson: sophisticated cryptography only matters when it solves a problem users can actually understand and experience.
What's next for ZK Pass
ZK Pass is currently an independent hackathon prototype using fictional identity data and PayPal Sandbox.
Our next goal is to explore reusable, selectively disclosable credentials across multiple payment providers and merchant platforms.
We envision a future where users verify their identity once and can subsequently prove only the information a transaction requires, without repeatedly exposing sensitive documents.
We also want to strengthen production readiness through secure issuer key management, independently audited circuits, certified identity verification integrations, and more robust credential revocation infrastructure.
Verify once. Prove anywhere. Pay without exposing everything.
