Junction runs the marketplace and an encrypted channel. Your payment credentials and private keys stay on infrastructure you control — the platform only ever moves ciphertext. Here is the whole flow, from your side.
Junction runs the marketplace and a blind relay; the sensitive handover happens on a data plane you host. Pick your role to follow your path — and see exactly where Junction can, and can't, see.
As a merchant, steps 1–3 and 5 are yours; the provider only fills in step 4. You host the hub once — it then serves every connection automatically.
You generate a keypair in your browser (Settings) and publish only the public half to a tamper-evident Key Transparency log. The private key never leaves you.
You publish your identity key exactly like a merchant — the handover is symmetric and each side verifies the other's key.
YouYou find a verified provider (or post a tender) and confirm the terms. Two clicks, both sides — a channel opens.
You confirm the merchant's request on the same terms. On the 2/2 confirmation a blind relay channel opens.
YouYour self-hosted hub (deployed once) mints a per-connection key and posts a signed handshake to the relay — where to seal the requisites.
The merchant's hub posts a signed handshake; you verify it against their KT key before trusting the address.
YouThe provider seals its payout requisites to your key and posts them. Junction relays only the ciphertext — never the plaintext.
You seal your requisites to the merchant's key — from the cabinet form, or automatically via a webhook + the PSP SDK.
ProviderYour hub decrypts the requisites on your own infrastructure and reports the channel healthy — the connection goes active. Route traffic and monitor.
Once the merchant's plane decrypts and confirms the channel, traffic flows and you settle. Junction's only fee: a flat 0.3% of your reported volume.
YouNew here? Follow these in order. You host one small hub (a single Docker container) on any machine you control — it unlocks your key at startup, so no private key ever sits in a file, and Junction never sees your keys or the requisites it decrypts.
Only prerequisite: Docker on any machine you control.Sign up at /signup and choose Merchant. Junction verifies your business (KYB) before you can connect to a provider.
In Settings → Generate Secret Key. Save the A1-… Secret Key and the account password you set there — together they unlock your hub. The private key is generated in your browser and never sent to Junction.
In Data plane, copy your organization id and click Issue token to mint a hub service token (jdp_…).
Pull Junction's published image and run it with the four values from steps 2–3. It roams your key at startup and registers itself — no build, no source:
Your hub serves a local admin at http://localhost:8787/admin. For each connection, set the settlement address where the provider pays you — it's sealed to that provider over the encrypted channel, never to Junction.
Browse verified providers in the marketplace, click Connect and confirm. A blind-relay channel opens and your hub posts a signed handshake automatically.
When the provider seals its integration to your hub, the connection turns active and your hub builds the connector from the signed catalog. Point your storefront at your hub over loopback:
Payment credentials and keys stay on infrastructure you control. Junction operates the marketplace and the encrypted channel — it never sees your funds, private keys or customer data.