Pearl Subscribe — Standing Orders for PRL

The service

Set up a recurring PRL payment — a salary, a retainer, a subscription. Pearl has no smart contracts, so this desk builds a consent structure: you fund one transaction with one output per period, then pre-sign each period's payment with a block-height locktime the network enforces. The merchant broadcasts each payment when it matures. You can cancel any not-yet-due period by spending its funding output back to yourself — the pre-signed payment can then never confirm.

Network Blockbook API (GET-only reads + broadcast; paste your own node-backed endpoint) Merchant address (who gets paid — a prl1p… Taproot address) Your address (anchor) (your prl1p… address — receives change and cancellations; keys stay with you) Amount per period (PRL) Fee rate (grains/vB) Period length Number of periods (1–60) First payment height Add an optional 1% builder tip per period to prl1p62v09vuzyd8kdz9l23jaf3kph4wwx6jqcmhkkhg8lhr2qlxky8psu3zw9d — paid ON TOP of the merchant amount (the merchant still gets the full amount every period), sealed in the descriptor and added as its own output in each pre-signed payment before signing. Mainnet only; waived when 1% would be below the dust floor. Off by default.

Honest limits — read before you fund anything

Consent, not enforcement. Pre-signed transactions are your standing permission — the chain cannot force the merchant to broadcast, nor force you to keep funding.
The merchant holds the payments. You hand them signed transactions; they broadcast each one after its locktime. If they lose them, nothing is paid (your funds stay reclaimable).
Cancel = double-spend. Cancelling a period spends its funding output back to you. If the merchant's payment confirms first, that period is paid — there is a race, and the desk shows it honestly.
Locktimes are block heights. Period lengths are approximate (Pearl targets 194 s/block); the network enforces heights, not dates.
Builder tip (optional, disclosed). If ticked, each period carries a 1% tip to the builder address ON TOP of the merchant amount — the merchant's amount never shrinks, the tip is sealed in the descriptor, and cancelling a period reclaims that period's tip along with the rest of its funding output.
Test on testnet first. Keys are wiped after signing and never stored, but verify the whole flow with tPRL before real money.

The terms

The tamper-evident subscription descriptor. The 64-bit fingerprint commits to merchant, anchor, amount, period, count, start height, and fee rate — editing any field breaks the fingerprint. Both parties keep a copy; the verifier re-checks everything.

Descriptor fingerprint
Merchant total
Builder tip (optional)
Funding total (incl. fee reserves)
Schedule

Period	Locktime (height)	≈ date	Merchant gets

The funding

One transaction with one output per period, each worth amount + fee reserve, all to your anchor address. Build it from your UTXOs (Blockbook scan or paste), sign it locally with your key — the page refuses any key that does not control the anchor address — then broadcast. The key is wiped the moment signing finishes.

Funding plan

Outputs
Per output
Total to fund

vout	Address	Value	Unlocks period

Your coins

or paste UTXOs (txid:vout:value-grains per line)

Your key (mnemonic, WIF, or 64-hex — wiped after signing)

The pre-signed payments

One payment per period, each spending its funding output: merchant gets the exact amount, dust-free change returns to your anchor, nLockTime is the period's height and sequence = 0xfffffffe so the network enforces it. Every signature is re-verified against its own BIP-341 digest before the hex is shown. Hand the signed bundle to the merchant — that is the standing order.

Funding txid

Period	Locktime	Payment txid (precomputed)	Fee

Your key (must control the anchor — wiped after signing)

The ledger

Watch every period: upcoming, due (locktime passed — the merchant may broadcast), paid (spent by the exact pre-signed payment), cancelled (spent by anything else). Reads Blockbook GET-only; paste values manually if the endpoint is unreachable.

Descriptor (paste the pearl-sub:v1 JSON) Funding txid

Period	Locktime	≈ date	Status	Detail

The escape hatch

Reclaim any period whose funding output is still unspent: spend it back to your anchor in a transaction with no locktime. Once that confirms, the pre-signed payment for that period can never confirm (its input is gone). The race is real — if the merchant already broadcast the payment and it confirms first, the period is paid. Check the ledger first.

Funding txid Period to cancel Your key (must control the anchor — wiped after signing)

The verifier

Paste any pearl-sub-bundle:v1 signed bundle — yours or the merchant's. The page re-validates the descriptor fingerprint, recomputes every payment txid from the funding plan, checks each signature against its own BIP-341 digest, and confirms amounts, change, locktimes, and sequences. Anything off is reported loudly, per period.

Signed bundle

The service

The terms

The funding

Funding plan

Your coins

The pre-signed payments

Signed bundle — send this to the merchant

The ledger

The escape hatch

The verifier