Skip to main content
AlgoVoi Payment Rails is a single encrypted, offline-verifiable bundle that turns a stablecoin payment intent into a signed, audit-ready proof across seven chains. It runs x402, MPP, AP2 and A2A on your own infrastructure: it holds no account with us, makes no outbound call to us, and never phones home. Your Falcon-1024-signed bundle licence is both the decryption key and the runtime licence, so one file extracts the bundle and unlocks every service. The install is designed to be short. One command brings the whole stack up, and one value brands every public surface to you. This guide walks the full path from a fresh machine to a live, white-labelled deployment.

​
1. What is in the bundle

Everything ships in one licence-gated .algv file. There is nothing else to download. SQLite-first: you are live in five minutes on a single file, and you upgrade to PostgreSQL by import when you want more write concurrency.

​
2. Install in one command

Prerequisites: a Linux host with Python 3.11+, run as root. Save your bundle licence as licence.key in the same directory as bundle.algv, algovoi_unbundle.py and enterprise-setup.sh.
That one command verifies your licence offline, extracts the wheels with per-file SHA-256 checks, installs the rails and the commercial layer into a dedicated virtualenv, generates and persists every production secret, initialises the database in WAL mode, installs each service as a hardened systemd unit with automatic restart, and fronts the whole stack with Caddy over HTTPS. When it finishes it prints the live URLs and your credentials.
  • With a real, reachable domain it obtains a Let’s Encrypt certificate automatically.
  • With no domain (or an internal name) it generates a self-signed certificate and makes no outbound call, so the same command works air-gapped.

​
Manual install (without systemd)

If you would rather run the stack yourself, extract and install the wheels, then start everything with the bundled launcher:
run_all.sh generates and persists the same secrets to .rails.env on first run, so a restart reuses them and your sessions and encrypted data survive.

​
3. Your identity, one knob

The deployment is white-label. You set your domain once, and the entire public surface reconfigures itself to you, with no per-endpoint configuration. ALGOVOI_DOMAIN sets GATEWAY_PUBLIC_URL=https://pay.yourco.com, and from that single value everything derives: No AlgoVoi identity, endpoints or references appear anywhere on your deployment. That is the whole configuration. You are live. Your A2A agent card and compliance receipts are cryptographically signed by default: the enterprise installer generates an Ed25519 key (VERASCORE_SIGNING_KEY_PEM_B64) that never leaves your host, and the card self-signs (A2A section 8.4) against your own /.well-known/jwks.json, never ours. To use a key you already control, set VERASCORE_SIGNING_KEY_PEM_B64 before install and the installer keeps it. The A2A surface is dual-compatible: one endpoint serves both A2A v0.3 and v1.0.1 clients. A client selects with the A2A-Version header (absent is treated as 0.3); the agent card advertises supportedInterfaces for HTTP+JSON and JSON-RPC at both versions, so clients self-select. Both a REST binding (/message:send, /tasks/*) and a JSON-RPC 2.0 endpoint (/a2a/jsonrpc) are exposed, each serving both versions.

​
4. Ports and consoles

The installer puts the payment rails on 443 and moves the admin surfaces up, so the consoles never contend with live transactions. The rails must own 443: external agents, payers and facilitators resolve you at https://pay.yourco.com with no port. If something else already listens on 443 on that host, move it, not the rails. The internal services bind to loopback only and are never exposed. Ports follow Ports and interfaces.

​
5. First sign-in and going live

When the installer finishes it prints the live URLs and your first credentials, which are also stored in /etc/algovoi/rails.env (root-readable):
  • ADMIN_API_KEY authenticates automation against the operator control plane on 8443.
  • PANEL_TOKEN is the login for the operator control panel on 9443.
  • The Substrate-2 panel admin token is written to the data directory (or read it from journalctl -u algovoi-substrate2-controlplane).
Sign in to the control panel at https://pay.yourco.com:9443/. It is the single operator console: from one login you manage merchants, payments, refunds, invoices, API keys, per-network configuration, store integrations, compliance posture and a tamper-evident audit log. Enrol authenticator-app 2FA on first sign-in. The full page-by-page walkthrough is in the Operator Control Panel guide. Point each chain at an RPC endpoint. The one step that makes settlement live is giving each chain you settle on an RPC endpoint, from the control panel’s per-network configuration. Until a chain has an endpoint it is configured but idle. Review the compliance posture. /compliance/attestation ships a UK regulatory posture (MLR 2017, SAMLA 2018 and similar) as a template. It is transparency metadata and does not affect payment processing. If you operate in another jurisdiction, review that posture for your own situation before relying on it publicly.

​
6. Optional configuration

You do not need any of these to be live. Set them in /etc/algovoi/rails.env and run sudo systemctl restart algovoi-gateway only to override the sensible defaults.

​
7. Verification checklist

Run these after install to confirm the deployment is healthy. This is the same sequence that a clean install is validated against before each release.

​
8. Security model

  • Self-hosted and air-gap capable: verifies and decrypts with no network, and runs with no phone-home.
  • Own custody: you hold the keys and take payout to your own addresses; the rails never hold your funds on our behalf.
  • Post-quantum evidence: receipts are anchored with Falcon-1024 and ML-DSA-65 over a JCS canonicalisation core, so proofs stay verifiable for the long term.
  • Hardened by default: Substrate Guard Pro and Edge Sentinel ship in the bundle, every service runs as a locked-down systemd unit, and the admin consoles are kept off the public rails port.
  • White-label: nothing on your deployment advertises AlgoVoi.
Next, keep the Operator Control Panel guide open as your day-to-day reference, and see the Payment Rails product page for what the rails do end to end.