How Zcan works.

You send to a one-time deposit address. Solvers compete in an auction to fill the swap, and the winner pays your destination directly. If the guaranteed minimum can't be met, the deposit is refunded.

Every order moves through these states, reported by the 1Click status API. The order page polls every 5 seconds; the app refreshes your other open orders every 10 seconds.

A quote has an expected output and a guaranteed minimum. The gap between them is the slippage tolerance. Drag the slider to see the trade-off with live prices.

Zcan supports whatever NEAR Intents supports, with ZEC always on one side. This chart reads the live asset list.

Split one amount across up to 10 recipients. Each recipient gets its own order and is paid by a market maker — never from your wallet — and you send each deposit at its scheduled time so the transfers aren't linked by timing.

• Non-custodialEach leg is an independent 1Click order. Nothing is pooled or held by Zcan.
• Unlinked payoutsRecipients see a solver's address, not yours. Uneven splits and delays make legs harder to correlate.
• LimitsDeposit addresses are transparent. For the most privacy, send from a shielded Zcash balance. Delays must fit within each order's deadline (a few hours).

Prices stream over a WebSocket. Quotes and payouts always come from NEAR Intents; the streamed prices are for display and estimates.

What leaves your device, and to whom, for each feature.

Zcan's server routes are thin proxies that keep keys server-side. They're the same endpoints the app uses.

curl https://your-zcan.app/api/tokens

# recipient: unified u1… or transparent t1…/tex1…; Sapling-only zs1… is rejected
curl -X POST https://your-zcan.app/api/quote \
  -H 'content-type: application/json' \
  -d '{"from":"nep141:btc.omft.near","to":"nep141:zec.omft.near",
       "amount":"0.01","mode":"float","dry":true,
       "recipient":"u1…","refundTo":"bc1…"}'

curl 'https://your-zcan.app/api/status?address=bc1q…'

{"txHash":"…","depositAddress":"bc1q…"}

curl https://your-zcan.app/api/chart

{"agentId":"breach-guide","values":{"breach":"…"}}

{"t":"status","text":"Searching the public web…"}
{"t":"search","query":"Example Corp breach 2026"}
{"t":"source","url":"https://…","title":"…"}
{"t":"text","text":"## What happened\n…"}
{"t":"done"}

Zcan is a Next.js app. Every key is optional; features without a key degrade gracefully.

# Swaps (optional; keyless quotes include a 0.2% 1Click fee)
ONECLICK_JWT=
ZCAN_FEE_RECIPIENT=   # your NEAR Intents account for a service fee
ZCAN_FEE_BPS=         # e.g. 50 = 0.5%

# Privacy agents — any OpenAI-compatible model (DeepSeek by default)
AI_API_KEY=
AI_BASE_URL=          # e.g. your own vLLM deployment (deploy/model); empty = DeepSeek
AI_MODEL=             # model for reports (required for a custom endpoint)
AI_PLAN_MODEL=        # optional faster model for plans
NEXT_PUBLIC_AI_SELF_HOSTED=   # true only for a model you deploy yourself
NEXT_PUBLIC_AI_MODEL_NAME=    # its name, e.g. "Zcan Privacy Model"
NEXT_PUBLIC_AI_HOST=          # GPU host, e.g. "Modal"
NEXT_PUBLIC_AI_PROVIDER=      # or: the outside AI company answering
TAVILY_API_KEY=       # optional live web search

# Optional: opt-in, anonymized training data for your own model
TRAINING_SIGNING_SECRET=   # 32+ random characters
TRAINING_ADMIN_TOKEN=      # 24+ chars; GET /api/training/export
KV_REST_API_URL=           # Upstash / Vercel KV Redis REST store
KV_REST_API_TOKEN=

# Optional: cookieless usage counts, proxied through /api/event
NEXT_PUBLIC_ANALYTICS=     # plausible | umami
ANALYTICS_SITE=            # Plausible domain or Umami website id