Cowrie Research

reclaim-protocol-primary-sources-2026-04-26

4 min read

Reclaim Protocol primary-source snapshot

Fetched: 2026-04-26 UTC

1) Core identity and why it exists

Source: https://www.reclaimprotocol.org/ Source: https://docs.reclaimprotocol.org/

Selected excerpts from the official materials:

Reclaim Protocol generates cryptographic proof directly from source - the university, the employer, the airline, the bank. Nothing to upload, nothing to forge.

If you have been verifying documents as part of your verification stack, you will need to upgrade your pipeline.

Additional signals from the docs:

  • Reclaim frames itself as a response to the rising weakness of document-upload verification in an AI world
  • The product positioning spans identity, education, employment, travel-status, and broader data verification use cases rather than only one regulated-identity niche
  • This is crypto-adjacent infrastructure with explicit cryptographic and zk/TLS roots, not just a conventional SaaS KYC wrapper

2) Verification flow and zkTLS posture

Source: https://docs.reclaimprotocol.org/

Selected excerpts from the docs:

All the verification happens on client side in a privacy preserving manner using zero knowledge proofs.

The technology we’ve built has since come to be known as zkTLS.

Additional signals from the docs:

  • The docs describe a concrete flow: detect the relevant HTTPS request, use provider rules plus regex/JSON-path extraction to isolate the required fact, validate the server certificate, then generate a proof over the encrypted response
  • The proof is meant to show both origin and content constraints without requiring broad disclosure of the entire response
  • The docs also expose a provider-exploration surface and tooling for building new providers, which suggests a generalized verification middleware layer rather than a static product catalog

3) SDK and developer surface

Source: https://docs.reclaimprotocol.org/ Source: https://raw.githubusercontent.com/reclaimprotocol/reclaim-js-sdk/master/README.md

Selected excerpts/signals from the public materials:

You can use one of these SDKs to start integrating: JS SDK, React Native SDK, Flutter SDK, iOS Swift SDK, Android Kotlin SDK, Blockchain SDK.

The Reclaim SDK now provides a simplified triggerReclaimFlow() method that automatically handles the verification process across different platforms and devices.

Additional signals from the docs and README:

  • The SDK docs make the product legible as developer infrastructure rather than only an end-user application
  • The JS SDK README walks through proof-request creation, request URLs, status URLs, and backend proof verification, which is useful operational evidence that the integration surface is mature
  • The docs also mention zkFetch for proving data returned by public or API-key-protected APIs, broadening the scope beyond only browser-login flows

4) Protocol and repository surface

Source: https://github.com/reclaimprotocol Source: https://raw.githubusercontent.com/reclaimprotocol/.github/main/profile/README.md Source: https://raw.githubusercontent.com/reclaimprotocol/attestor-core/master/README.md

Selected excerpts/signals from the public materials:

Reclaim allows your users to bring their data from any website to yours.

The attestor-core package is the core implementation of the Reclaim protocol.

An “attestor” is a server that sits between the reclaim user & the internet.

Additional signals from the public materials:

  • The GitHub org surfaces protocol-level repos for attestor-core, JS SDK, TLS components, ZK symmetric crypto, and docs
  • attestor-core describes the witness/attestor role, SDK compatibility, and even an AVS-related decentralization path, which is much richer than a typical startup marketing site
  • The repo inventory supports cataloging Reclaim as verification middleware/protocol infrastructure rather than just a wrapper around third-party APIs

5) Formal research and security posture

Source: https://docs.reclaimprotocol.org/ Source: https://eprint.iacr.org/2024/733

Selected excerpts/signals from the official materials:

Whitepaper | PDF

Formal Security Analysis | ePrint

Proxying Is Enough: Security of Proxying in TLS Oracles and AEAD Context Unforgeability

Additional signals from the research materials:

  • The linked IACR ePrint formalizes proxy-based TLS-oracle security and argues that the proxy model can preserve security in common scenarios while saving 60-90% in running time
  • Reclaim’s docs connecting product docs to both a whitepaper and a cryptographic security analysis is unusually strong primary-source support for a startup-oriented verification stack
  • The strongest operational source of truth still appears to be the docs portal plus core repos, while the papers help explain the security framing and cryptographic lineage

Notes

  • Reclaim appears best cataloged as zkTLS / cryptographic verification middleware and identity-and-reputation proof infrastructure.
  • The project is broader than classic KYC: its official use cases cover education, employment, status, age/identity, and API/web data verification.
  • The most useful primary sources in this pass were the docs portal, homepage, core repos, JS SDK README, attestor-core README, and linked formal security analysis.

Graph View