Bolt Card primary sources — 2026-05-02

Project status in this pass

• No canonical standalone whitepaper or litepaper surfaced.
• The clearest current source of truth is the official site plus the first-party GitHub documentation set.
• The materials make Bolt Card look like a reusable contactless payments stack, not just a branded NFC card.

Primary-source snapshots

1) Official site overview

• URL: https://www.boltcard.org/
• Key excerpt:
  • The site explains that each NFC card is programmed with an lnurlw:// address and secure keys that generate a new unique hash on every scan.
  • It says the merchant uses those values to make a one-time call to the card service, which then applies payment rules.
  • This is strong evidence that the key product is a card-plus-service architecture.

2) GitHub README

• URL: https://raw.githubusercontent.com/boltcard/boltcard/main/README.md
• Key excerpt:
  • The README says the bolt card enables customer payments at a merchant point of sale over Lightning.
  • It also says the provided service software can host bolt cards for yourself and others.
  • The linked document set covers system design, specification, privacy, installation, and card-creation workflows.

3) System overview

• URL: https://raw.githubusercontent.com/boltcard/boltcard/main/docs/SYSTEM.md
• Key excerpt:
  • The system doc diagrams a multi-party flow among the NFC card, merchant POS, merchant server, bolt card server, and customer and merchant Lightning nodes.
  • The sequence makes it clear that Bolt Card depends on operator infrastructure on both sides, not only card hardware.

4) Specification

• URL: https://raw.githubusercontent.com/boltcard/boltcard/main/docs/SPEC.md
• Key excerpt:
  • The specification says Bolt Card uses LUD-03 withdrawRequest, LUD-17 raw URL schemes, NDEF, and replay protection with NXP NTAG 424 DNA Secure Unique NFC Message features.
  • It also says the server should verify encrypted and authenticated card values, accept only increasing counters, and may enforce rules like per-transaction limits, daily limits, merchant allowlists, or location checks.

5) Privacy note

• URL: https://raw.githubusercontent.com/boltcard/boltcard/main/docs/CARD_PRIVACY.md
• Key excerpt:
  • The privacy document defines minimal, good, and best privacy levels depending on whether the card exposes a static identifier or plaintext UID.
  • It explicitly warns that early implementations do not fully maximize privacy and treats point-of-sale tracking resistance as a design variable.

6) FAQ

• URL: https://raw.githubusercontent.com/boltcard/boltcard/main/docs/FAQ.md
• Key excerpt:
  • The FAQ says Lightning routing quality affects failures and latency, offers operational advice around channel connectivity and fee limits, and notes that paying and invoicing LND nodes needed to be separate instances in tested setups.
  • This reinforces that Bolt Card is tightly coupled to real Lightning operations, not just static card issuance.

Working conclusion

Bolt Card is best cataloged as contactless Bitcoin Lightning payment infrastructure with a reusable card-service stack, LNURL-withdraw merchant coordination, rule-engine enforcement, and privacy-aware NFC design. The decisive evidence in this pass was the combination of self-hostable service software, explicit system architecture, Secure Unique NFC Message replay protection, and first-party privacy-level documentation.