Pools and passkeys
What a pool is
An off-chain grouping of receivables that share one passkey. The blockchain knows nothing about pools.
A pool is sold as a single block to exactly one funder, so custody is uniform across it: every receivable in a pool is either all still in custody, or all held by the same funder.
A pool has a code (3 to 41 characters, letters, digits and - _ / .), a
free-text name, and a passkey.
What a passkey is
The only secret protecting a pool. Anyone holding a Loan ID and its pool passkey can verify that receivable.
It is required and can be up to 64 characters. There is no minimum length or character rule, but:
Choose a long one. Loan IDs usually run in sequence, which makes them easy to guess, so the passkey is the only thing deciding who can look your receivables up. A four-digit code is far weaker than a phrase. The verify endpoint is rate-limited per IP address, which blunts a brute-force attempt but is not a substitute for a passkey worth guessing at.
A passkey cannot be rotated
The on-chain identifier is the hash of the Loan ID and the passkey together. Change the passkey and you change the identity of every certificate already registered in that pool, orphaning all of them.
So rotating one is a deliberate operation requiring re-registration, not a settings change.
- Do not lose it. You can read your own pool's passkey back from the pool page (a Reveal button, which re-masks after about 30 seconds), but record it somewhere safe regardless.
- If a passkey leaks, treat it as an incident and raise it with the STOKR team. It is not a settings problem.
Who can read a passkey
Only a party that already holds it:
- The originator that owns the pool.
- A funder whose vault currently holds at least one receivable in it. A funder who has sold the pool on loses that access.
No other participant and no other screen can obtain it. Passkeys are held server-side and are never rendered into a page by default. The value is fetched only when Reveal is clicked, so a pool page nobody reveals it on never carries the value at all.
The one other place a passkey appears is the loan tape export offered after registration, because you type it into the download dialog at that moment. That file is how a funder verifies a whole pool without typing anything, and it is also why that file goes to the intended funder and nowhere else.
What a passkey does not do
It controls who can look a pool's receivables up, and nothing more. It gives nobody a claim on the loans and no ability to move, sell or alter anything. Treat it like a password all the same, because it is what keeps your pool from being browsed by people you have not shared it with.