Receiving & disclosure

The console's Identity panel handles the two sides of being a participant: getting paid, and — when you choose — proving what you received.

Your meta-address — share to receive

The panel shows YOUR META-ADDRESS as a hestia1… string with a one-click copy. This is the public identifier anyone uses to pay you privately:

• Give it to a sender; they paste it into their Send field.
• It encodes only your public keys (SK, VK) plus a chain tag — never anything that can spend or read your notes. See meta-addresses.
• After someone pays you, press sync to discover the incoming note and see your balance rise.

Sharing your meta-address is always safe. It is the address equivalent of handing out an email address, not a password.

Export viewing key — selective disclosure

Under SELECTIVE DISCLOSURE, export viewing key reveals the hex of your viewing secret vk. Handing this to an auditor lets them reconstruct your entire receiving history — and only yours:

export viewing key  →  0x…   (give to an auditor)

With it (plus access to the public ciphertexts via the indexer), an auditor can:

• enumerate every note you received, with amount, token, and lineage label; and
• verify each against the on-chain commitments.

What it does not grant:

• the ability to spend — that needs sk, which is never disclosed; or
• visibility into anyone else — every note is sealed to its own recipient's key.

This is the consent-based disclosure described in viewing keys. It turns "prove your books" into a single key exchange that is scoped, read-only, and verifiable.

The viewing key cannot move your funds, but it exposes everything you've received. Treat it as sensitive: export and share it only with a party you intend to let audit you, and prefer a fresh identity if you want to compartmentalize what a given auditor can see.

Putting it together

Pairing the two halves of Hestia in one panel is the point: your provenance is proven publicly and privately on every spend (association sets), while your history is disclosed only when you hand over a viewing key. Privacy by default, disclosure by consent.