> The recipient has registered their address and private view key with a watcher. The view key lets it see incoming payments; it can never spend them.
Noooo, Monero tips should allow the recipient to...
Fair point and that's what 0.17 changed: a personal watcher runs on your own machine, so the view key never leaves you and since 0.18 amounts stay private too. The tx-proof route is interesting: no view key at all. The blocker is wallets: none hands txid + tx key back to the app yet, so senders would copy them by hand. If wallets add a callback URI, I'd gladly support it.