diff --git a/cuhttp/shared_routes.go b/cuhttp/shared_routes.go
index c737e6797..f6e272df2 100644
--- a/cuhttp/shared_routes.go
+++ b/cuhttp/shared_routes.go
@@ -7,9 +7,11 @@ import (
 	"golang.org/x/xerrors"
 
 	"github.com/filecoin-project/curio/deps"
+	"github.com/filecoin-project/curio/lib/ethchain"
 	"github.com/filecoin-project/curio/market/denylist"
 	ipni_provider "github.com/filecoin-project/curio/market/ipni/ipni-provider"
 	"github.com/filecoin-project/curio/market/retrieval"
+	"github.com/filecoin-project/curio/market/retrieval/gate"
 )
 
 // MountRetrievalPublicRoutes mounts piece/IPFS retrieval with bad-bits denylist filtering.
@@ -17,7 +19,20 @@ import (
 func MountRetrievalPublicRoutes(ctx context.Context, r *chi.Mux, d *deps.Deps) *denylist.Filter {
 	df := denylist.NewFilter(ctx, d.Cfg.HTTP.DenylistServers)
 	rp := retrieval.NewRetrievalProvider(ctx, d.DB, d.IndexStore, d.CachedPieceReader, df)
-	retrieval.Router(r, rp, df)
+
+	// Opt-in retrieval permissioning. The resolver only dials the eth node on a gated request, so a
+	// disabled gate (the default) costs nothing.
+	ethGet := func(context.Context) (ethchain.EthClient, error) {
+		if d.EthClient == nil {
+			return nil, xerrors.New("eth client not configured; gated retrieval requires it")
+		}
+		return d.EthClient.Val()
+	}
+	res := gate.NewResolver(d.DB, d.IndexStore, ethGet)
+	pieceGate := gate.NewMiddleware(d.Cfg.HTTP.EnableGatedRetrieval, "/piece/", res)
+	ipfsGate := gate.NewContentMiddleware(d.Cfg.HTTP.EnableGatedRetrieval, "/ipfs/", res)
+
+	retrieval.Router(r, rp, df, pieceGate, ipfsGate)
 	return df
 }
 
diff --git a/deps/config/types.go b/deps/config/types.go
index 070518214..dabcd84c7 100644
--- a/deps/config/types.go
+++ b/deps/config/types.go
@@ -1023,6 +1023,13 @@ type HTTPConfig struct {
 	// will receive HTTP 503. (Default: ["https://badbits.dwebops.pub/denylist.json"])
 	// Updates will affect running instances.
 	DenylistServers *Dynamic[[]string]
+
+	// EnableGatedRetrieval turns on opt-in permissioning for PDP piece retrieval (/piece/{cid}).
+	// When true, a request for a piece whose every containing data set is marked private (via the
+	// on-chain "withRetrievalACL" data-set metadata flag) must present a valid, dataset-scoped,
+	// payer-signed retrieval credential; pieces in any public data set stay publicly retrievable.
+	// When false (default), all retrieval is public — the historical behaviour. (Default: false)
+	EnableGatedRetrieval bool
 }
 
 // CompressionConfig holds the compression levels for supported types
diff --git a/market/retrieval/gate/RETRIEVAL-AUTH-SPEC.md b/market/retrieval/gate/RETRIEVAL-AUTH-SPEC.md
new file mode 100644
index 000000000..52a96fb0a
--- /dev/null
+++ b/market/retrieval/gate/RETRIEVAL-AUTH-SPEC.md
@@ -0,0 +1,271 @@
+# Curio Retrieval Authorization — wire-format spec
+
+**Status:** draft for review by the PDP-retrieval and PoRep-market teams. A **working reference
+implementation** of this exact scheme (the PDP side) exists on Curio branch
+`feat/gated-pdp-retrievals` (`market/retrieval/gate`), verified by unit + integration tests and a
+live devnet run.
+**Goal:** a single credential scheme for authenticated piece retrieval through Curio, usable by any
+storage subsystem (FWSS/PDP data sets, PoRep market deals, …). Both subsystems serve pieces through
+the same Curio retrieval endpoint (`GET /piece/{cid}`, `/ipfs/{cid}`), so they should share one
+gate and one credential format rather than two lookalikes.
+
+This is normative. **MUST/SHOULD/MAY** per RFC 2119.
+
+---
+
+## 1. Model
+
+Access is **capability + proof-of-possession (PoP)** — two EIP-712 objects, never one:
+
+- **`RetrievalVoucher`** — the *capability*. The resource's on-chain **owner (payer)** signs it
+  **once, offline**, delegating access for a whole *scope* (a data set or a deal) to a **grantee**
+  address. Reusable, long-lived, freely storable/transferable.
+- **`RetrievalProof`** — *proof of possession*. The requester signs it **fresh, per request**,
+  binding the **exact resource CID** and a short deadline.
+
+A gated request MUST carry a proof (always) and, for delegated access, the voucher.
+
+> **Why not a bearer voucher.** A voucher presented alone is a bearer token: anyone who captures it
+> can retrieve until its deadline; the `grantee` field is decorative. Requiring a fresh,
+> resource-bound proof signed by the grantee's key means **a stolen voucher is useless** — only the
+> holder of the grantee key can mint a matching proof. The grantee is typically offline when the
+> voucher is issued, so this is a capability-delegation model, not an interactive (OIDC-style) grant.
+
+**Statelessness.** Replay protection is time-bounded, not stored: the server bounds how far in the
+future a proof's `deadline` may be (`MAX_PROOF_TTL`) and binds the proof to the resource. No nonce
+database. A captured *full request* (proof+voucher) is therefore replayable only within the proof's
+short window and only for that one piece; closing that residual window would require a server-side
+seen-cache and is intentionally out of scope for v1.
+
+---
+
+## 2. Notation & primitives
+
+- Signatures are secp256k1 ECDSA over the EIP-712 digest (EIP-191 `0x19 0x01` prefix), recovered via
+  `ecrecover`. 65-byte `r‖s‖v`, `v ∈ {27,28}` (implementations MUST also accept `{0,1}`).
+- Verification is **off-chain** (in Curio). The EIP-712 `verifyingContract` is used purely for
+  domain separation; no on-chain call is required to verify a credential.
+- Portable across any secp256k1 signer: `viem` / MetaMask `eth_signTypedData_v4` / `@noble/curves` /
+  go-ethereum / a headless agent. No wallet interaction is required at request time for machine
+  clients; a human delegates once (voucher) and their software mints proofs.
+
+---
+
+## 3. EIP-712 domain
+
+```
+EIP712Domain(string name, string version, uint256 chainId, address verifyingContract)
+```
+
+| Field | Value |
+|---|---|
+| `name` | `"CurioRetrieval"` |
+| `version` | `"1"` |
+| `chainId` | the FEVM chain id (e.g. `314159` calibration, `314` mainnet) |
+| `verifyingContract` | **the owning service's contract** for the scope (see §5) |
+
+`verifyingContract` MUST be the service contract that owns the scope — the **FWSS service address**
+for a PDP data set, the **PoRep market contract** for a deal. This gives cross-service domain
+separation: a voucher minted for a PoRep deal cannot be replayed against a PDP data set of the same
+numeric id, because the digest differs.
+
+---
+
+## 4. Structures
+
+### 4.1 RetrievalVoucher (capability)
+
+```
+RetrievalVoucher(address grantee, uint256 scope, uint256 issuedAt, uint256 deadline)
+```
+
+| Field | Meaning |
+|---|---|
+| `grantee` | the delegate's address; the proof for this voucher MUST recover to it |
+| `scope` | the access unit — a **data set id** (PDP) or **deal id** (PoRep), see §5 |
+| `issuedAt` | unix seconds, for audit |
+| `deadline` | unix seconds; the voucher is valid while `now ≤ deadline` (MAY be long-lived) |
+
+Signed by the scope's **owner (payer)**.
+
+### 4.2 RetrievalProof (proof of possession)
+
+```
+RetrievalProof(uint256 scope, string resource, uint256 deadline)
+```
+
+| Field | Meaning |
+|---|---|
+| `scope` | MUST equal the voucher's `scope` (or, for owner-direct access, any scope the owner owns that contains the piece) |
+| `resource` | the requested piece CID **exactly as it appears in the request path** (see §6) |
+| `deadline` | unix seconds; MUST be near-future (`now ≤ deadline ≤ now + MAX_PROOF_TTL`) |
+
+Signed **fresh per request** by the requester (the grantee, or the owner for owner-direct access).
+
+`MAX_PROOF_TTL` is server policy; RECOMMENDED **≤ 5 minutes**.
+
+---
+
+## 5. `scope`, `resource`, and service binding
+
+- **`scope`** is a `uint256` that a service interprets: PDP → `dataSetId`; PoRep → `dealId`. Each
+  scope belongs to exactly one service, from which Curio derives the `verifyingContract` and the
+  `owner`.
+- **`resource`** is the CID string from the request path: the piece CID for `GET /piece/{cid}`, or
+  the payload/root CID for `GET /ipfs/{cid}[/subpath]` (gated on the root CID; sub-blocks that
+  resolve to other pieces are not individually re-checked).
+- A piece MAY belong to multiple scopes (content-addressed dedup). The credential names the scope it
+  claims through; Curio verifies the piece is actually in that scope. **Public-wins:** if the piece
+  is in any non-access-controlled scope, it is served without a credential (service policy).
+
+---
+
+## 6. Credential token & presentation
+
+Wire token = base64url(JSON), no padding:
+
+```json
+{
+  "scheme": "eip712",
+  "proof":     { "scope": "1001", "resource": "bafk…", "deadline": "1767225600" },
+  "proofSig":  "0x…",
+  "voucher":   { "grantee": "0xabc…", "scope": "1001", "issuedAt": "1767139200", "deadline": "1767744000" },
+  "voucherSig":"0x…"
+}
+```
+
+- `voucher`/`voucherSig` are **omitted for owner-direct access** (the proof signer is the owner).
+- uint256 fields are **decimal strings**; addresses and signatures are `0x`-hex; `resource` is the
+  CID string.
+
+Presentation (a client MUST support at least one; a gate MUST accept both):
+
+- `Authorization: CurioRetrieval <token>` — SDK / server / browser `fetch` / headless agent.
+- `?auth=<token>` query parameter — header-less browser tags (`<img>`/`<video>`/`<a download>`).
+  Because the token embeds a fresh proof, a leaked `?auth=` URL is a short-lived, single-resource
+  capability, not a durable bearer token.
+
+Gated responses MUST be `Cache-Control: private, no-store`.
+
+---
+
+## 7. Verification algorithm (normative)
+
+For a request on resource CID `R`, with parsed credential `C`:
+
+1. `C.scheme` MUST be `"eip712"`, else reject.
+2. Resolve the access-controlled scopes containing `R` (per service). If `R` is in any public scope
+   → **serve** (public-wins). Else continue; let `PRIV` be the set of controlling scopes.
+3. `C.proof.resource` MUST equal `R` (byte-exact CID string).
+4. `now ≤ C.proof.deadline ≤ now + MAX_PROOF_TTL`, else reject.
+5. `C.proof.scope ∈ PRIV`, else reject.
+6. Resolve `C.proof.scope` → owning service → `verifyingContract` and `owner`.
+7. `requester = ecrecover(EIP712(domain(verifyingContract), RetrievalProof, C.proof), C.proofSig)`.
+8. If `requester == owner` → **authorize** (owner-direct; voucher not required).
+9. Else the voucher is REQUIRED:
+   - `C.voucher` present; `C.voucher.scope == C.proof.scope`; `now ≤ C.voucher.deadline`;
+     `C.voucher.grantee == requester`;
+   - `issuer = ecrecover(EIP712(domain(verifyingContract), RetrievalVoucher, C.voucher), C.voucherSig)`;
+     `issuer == owner`.
+   - all hold → **authorize**.
+10. Else **deny** (403).
+
+Response codes: missing credential → **401**; present but unauthorized/invalid → **403**;
+resolver/chain/DB failure → **503** (fail closed — never serve a controlled piece on error).
+
+---
+
+## 8. Service integration (the resolver contract)
+
+A subsystem plugs into the shared gate by implementing a small resolver — the Curio gate's `Backend`
+interface, one method group per concept:
+
+```
+ScopesForResource(ctx, resourceCID) -> []{ scope, service }   // piece → the scopes that contain it
+IsScopePrivate(ctx, service, scope) -> bool                    // access-controlled?
+ScopeOwner(ctx, service, scope)     -> address                 // the payer/owner (EIP-712 signer to match)
+ServiceContract(service)            -> address                 // the domain verifyingContract
+ChainID(ctx)                        -> uint256
+```
+
+- **PDP/FWSS:** scope = `dataSetId`; owner = FWSS-view `GetDataSet().Payer`; service contract =
+  FWSS service address; "private" = the `withRetrievalACL` data-set-metadata key present.
+- **PoRep market:** scope = `dealId`; owner = the deal's payer; service contract = the PoRep market
+  contract; "private" = the deal's equivalent opt-in flag.
+
+The gate's crypto/verification path is identical for both.
+
+---
+
+## 9. Security considerations
+
+- **Theft resistance.** The voucher alone authorizes nothing; every request needs a fresh
+  grantee-signed, resource-bound proof. A leaked voucher/token cannot be used without the grantee
+  key.
+- **Residual replay window.** A captured full request replays only within `MAX_PROOF_TTL` and only
+  for that resource. An OPTIONAL server-side proof-`(signer,resource,deadline)` seen-cache closes it
+  at the cost of statelessness.
+- **Contract/multisig owners (EIP-1271).** v1 assumes an EOA owner (ecrecover). A scope whose owner
+  is a contract cannot verify by ecrecover; EIP-1271 support is a documented follow-up.
+- **Revocation.** There is no revocation before `deadline`; the voucher's short-to-medium lifetime is
+  the only kill switch in v1. If pre-expiry revocation is later required, add a `nonce` field plus an
+  owner-published deny-list — deliberately deferred until a concrete need arises.
+- **`/ipfs/` scoping.** Gated on the requested root/path CID's piece(s); DAG sub-blocks resolving to
+  other pieces are not individually re-checked.
+- **Domain separation.** `verifyingContract` prevents cross-service and cross-network replay; clients
+  MUST sign under the owning service's contract.
+
+---
+
+## 10. Worked example
+
+Owner `0x47cc…` delegates PDP data set `1001` to grantee `0xabc…`, then the grantee retrieves piece
+`bafk…`:
+
+**Voucher (signed once, offline, by the owner):**
+```json
+{ "domain": { "name": "CurioRetrieval", "version": "1", "chainId": 314159, "verifyingContract": "0x<FWSS>" },
+  "types": { "RetrievalVoucher": [
+      {"name":"grantee","type":"address"},{"name":"scope","type":"uint256"},
+      {"name":"issuedAt","type":"uint256"},{"name":"deadline","type":"uint256"} ] },
+  "primaryType": "RetrievalVoucher",
+  "message": { "grantee":"0xabc…","scope":"1001","issuedAt":"1767139200","deadline":"1767744000" } }
+```
+
+**Proof (signed fresh per request, by the grantee):**
+```json
+{ "domain": { "name": "CurioRetrieval", "version": "1", "chainId": 314159, "verifyingContract": "0x<FWSS>" },
+  "types": { "RetrievalProof": [
+      {"name":"scope","type":"uint256"},{"name":"resource","type":"string"},{"name":"deadline","type":"uint256"} ] },
+  "primaryType": "RetrievalProof",
+  "message": { "scope":"1001","resource":"bafk…","deadline":"1767225600" } }
+```
+
+Both go into the token (§6); the request carries it via header or `?auth=`.
+
+---
+
+## 11. Migration from the two current implementations
+
+**PDP retrieval gate (this repo) — DONE (reference implementation).** Branch
+`feat/gated-pdp-retrievals` already implements this exact scheme: `RetrievalVoucher` /
+`RetrievalProof`, `scope`, `deadline`, `verifyingContract` (= the FWSS service address), and
+string-encoded uint256s — the `market/retrieval/gate` package. Verified by unit + HTTP integration
+tests and a live devnet run (owner-direct, delegated, stolen-voucher→403, resource/expiry binding).
+Treat it as the working reference for the wire format; the client signer lives in
+`synapse-sdk/examples/authz/retrieval.mjs`.
+
+**PoRep market voucher — adopt the missing half + shared shape:**
+- add the `RetrievalProof` PoP object and require it on every request (the current single voucher is
+  bearer — a stolen voucher is usable until `deadline`);
+- rename domain `PoRepPieceAccess` → `CurioRetrieval`; `dealId` → `scope`;
+- add `issuedAt` to the voucher (audit);
+- keep `verifyingContract` (the PoRep market contract), `grantee`, `deadline` — already aligned.
+
+---
+
+## 12. Open questions for the two teams
+1. `MAX_PROOF_TTL` value (RECOMMENDED ≤ 5 min) and whether a seen-cache is wanted for v1.
+2. Whether to unify on `scope` (uint256) or keep service-specific field names (`dataSetId`/`dealId`)
+   with a shared proof — `scope` maximizes shared verification code.
+3. EIP-1271 timeline (contract/multisig owners).
\ No newline at end of file
diff --git a/market/retrieval/gate/eip712.go b/market/retrieval/gate/eip712.go
new file mode 100644
index 000000000..d5d947efd
--- /dev/null
+++ b/market/retrieval/gate/eip712.go
@@ -0,0 +1,181 @@
+package gate
+
+import (
+	"fmt"
+	"math/big"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/common/math"
+	"github.com/ethereum/go-ethereum/crypto"
+	"github.com/ethereum/go-ethereum/signer/core/apitypes"
+	"golang.org/x/xerrors"
+)
+
+// The converged Curio retrieval-authorization scheme (see RETRIEVAL-AUTH-SPEC.md). Two EIP-712
+// objects under domain CurioRetrieval/1/chainId/verifyingContract, where verifyingContract is the
+// owning service's contract (the FWSS service address for PDP data sets):
+//
+//   RetrievalVoucher — the CAPABILITY. The scope's owner (payer) signs it once, offline, to delegate
+//                      access for a whole scope (a data set id here) to a grantee key.
+//   RetrievalProof   — PROOF OF POSSESSION. The requester signs it fresh per request, binding the
+//                      exact resource CID and a short deadline. Stateless replay protection.
+
+const (
+	eip712DomainName    = "CurioRetrieval"
+	eip712DomainVersion = "1"
+	primaryTypeVoucher  = "RetrievalVoucher"
+	primaryTypeProof    = "RetrievalProof"
+)
+
+type RetrievalVoucher struct {
+	Grantee  common.Address
+	Scope    uint64 // data set id (PDP) / deal id (PoRep)
+	IssuedAt int64
+	Deadline int64
+}
+
+// RetrievalProof binds a single request: the resource CID exactly as it appears in the URL and a
+// short deadline.
+type RetrievalProof struct {
+	Scope    uint64
+	Resource string
+	Deadline int64
+}
+
+var domainFields = []apitypes.Type{
+	{Name: "name", Type: "string"},
+	{Name: "version", Type: "string"},
+	{Name: "chainId", Type: "uint256"},
+	{Name: "verifyingContract", Type: "address"},
+}
+
+func domain(chainID *big.Int, verifyingContract common.Address) apitypes.TypedDataDomain {
+	return apitypes.TypedDataDomain{
+		Name:              eip712DomainName,
+		Version:           eip712DomainVersion,
+		ChainId:           (*math.HexOrDecimal256)(chainID),
+		VerifyingContract: verifyingContract.Hex(),
+	}
+}
+
+func eip712Digest(primaryType string, fields []apitypes.Type, msg apitypes.TypedDataMessage, chainID *big.Int, vc common.Address) ([]byte, error) {
+	td := apitypes.TypedData{
+		Types:       apitypes.Types{"EIP712Domain": domainFields, primaryType: fields},
+		PrimaryType: primaryType,
+		Domain:      domain(chainID, vc),
+		Message:     msg,
+	}
+	ds, err := td.HashStruct("EIP712Domain", td.Domain.Map())
+	if err != nil {
+		return nil, xerrors.Errorf("hash EIP712Domain: %w", err)
+	}
+	sh, err := td.HashStruct(primaryType, msg)
+	if err != nil {
+		return nil, xerrors.Errorf("hash %s: %w", primaryType, err)
+	}
+	raw := append([]byte{0x19, 0x01}, ds...)
+	return crypto.Keccak256(append(raw, sh...)), nil
+}
+
+func recover65(digest, sig []byte) (common.Address, error) {
+	if len(sig) != 65 {
+		return common.Address{}, xerrors.Errorf("signature must be 65 bytes, got %d", len(sig))
+	}
+	rsv := make([]byte, 65)
+	copy(rsv, sig)
+	if rsv[64] >= 27 {
+		rsv[64] -= 27
+	}
+	pub, err := crypto.SigToPub(digest, rsv)
+	if err != nil {
+		return common.Address{}, xerrors.Errorf("ecrecover: %w", err)
+	}
+	return crypto.PubkeyToAddress(*pub), nil
+}
+
+func voucherFields() []apitypes.Type {
+	return []apitypes.Type{
+		{Name: "grantee", Type: "address"},
+		{Name: "scope", Type: "uint256"},
+		{Name: "issuedAt", Type: "uint256"},
+		{Name: "deadline", Type: "uint256"},
+	}
+}
+
+func voucherMsg(v RetrievalVoucher) apitypes.TypedDataMessage {
+	return apitypes.TypedDataMessage{
+		"grantee":  v.Grantee.Hex(),
+		"scope":    new(big.Int).SetUint64(v.Scope).String(),
+		"issuedAt": big.NewInt(v.IssuedAt).String(),
+		"deadline": big.NewInt(v.Deadline).String(),
+	}
+}
+
+func proofFields() []apitypes.Type {
+	return []apitypes.Type{
+		{Name: "scope", Type: "uint256"},
+		{Name: "resource", Type: "string"},
+		{Name: "deadline", Type: "uint256"},
+	}
+}
+
+func proofMsg(p RetrievalProof) apitypes.TypedDataMessage {
+	return apitypes.TypedDataMessage{
+		"scope":    new(big.Int).SetUint64(p.Scope).String(),
+		"resource": p.Resource,
+		"deadline": big.NewInt(p.Deadline).String(),
+	}
+}
+
+func VoucherDigest(v RetrievalVoucher, chainID *big.Int, vc common.Address) ([]byte, error) {
+	return eip712Digest(primaryTypeVoucher, voucherFields(), voucherMsg(v), chainID, vc)
+}
+func ProofDigest(p RetrievalProof, chainID *big.Int, vc common.Address) ([]byte, error) {
+	return eip712Digest(primaryTypeProof, proofFields(), proofMsg(p), chainID, vc)
+}
+
+// RecoverVoucherSigner recovers the address that signed the voucher (must equal the scope owner).
+func RecoverVoucherSigner(v RetrievalVoucher, chainID *big.Int, vc common.Address, sig []byte) (common.Address, error) {
+	d, err := VoucherDigest(v, chainID, vc)
+	if err != nil {
+		return common.Address{}, err
+	}
+	return recover65(d, sig)
+}
+
+// RecoverProofSigner recovers the address that signed the proof (the requester: owner or grantee).
+func RecoverProofSigner(p RetrievalProof, chainID *big.Int, vc common.Address, sig []byte) (common.Address, error) {
+	d, err := ProofDigest(p, chainID, vc)
+	if err != nil {
+		return common.Address{}, err
+	}
+	return recover65(d, sig)
+}
+
+func sign65(digest, priv []byte) ([]byte, error) {
+	key, err := crypto.ToECDSA(priv)
+	if err != nil {
+		return nil, xerrors.Errorf("parse private key: %w", err)
+	}
+	sig, err := crypto.Sign(digest, key)
+	if err != nil {
+		return nil, fmt.Errorf("sign: %w", err)
+	}
+	sig[64] += 27
+	return sig, nil
+}
+
+func SignVoucher(v RetrievalVoucher, chainID *big.Int, vc common.Address, priv []byte) ([]byte, error) {
+	d, err := VoucherDigest(v, chainID, vc)
+	if err != nil {
+		return nil, err
+	}
+	return sign65(d, priv)
+}
+func SignProof(p RetrievalProof, chainID *big.Int, vc common.Address, priv []byte) ([]byte, error) {
+	d, err := ProofDigest(p, chainID, vc)
+	if err != nil {
+		return nil, err
+	}
+	return sign65(d, priv)
+}
diff --git a/market/retrieval/gate/eip712_test.go b/market/retrieval/gate/eip712_test.go
new file mode 100644
index 000000000..8754707d6
--- /dev/null
+++ b/market/retrieval/gate/eip712_test.go
@@ -0,0 +1,57 @@
+package gate
+
+import (
+	"math/big"
+	"testing"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/crypto"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVoucherSignRecoverRoundTrip(t *testing.T) {
+	key, _ := crypto.GenerateKey()
+	priv := crypto.FromECDSA(key)
+	addr := crypto.PubkeyToAddress(key.PublicKey)
+	chainID := big.NewInt(314159)
+	vc := common.HexToAddress("0x00000000000000000000000000000000000000AA")
+
+	v := RetrievalVoucher{Grantee: addr, Scope: 42, IssuedAt: 1000, Deadline: 2000}
+	sig, err := SignVoucher(v, chainID, vc, priv)
+	require.NoError(t, err)
+	got, err := RecoverVoucherSigner(v, chainID, vc, sig)
+	require.NoError(t, err)
+	require.Equal(t, addr, got)
+
+	v2 := v
+	v2.Scope = 43
+	got2, _ := RecoverVoucherSigner(v2, chainID, vc, sig)
+	require.NotEqual(t, addr, got2)
+
+	// verifyingContract domain separation
+	got3, _ := RecoverVoucherSigner(v, chainID, common.HexToAddress("0x00000000000000000000000000000000000000BB"), sig)
+	require.NotEqual(t, addr, got3)
+	// chainId binding
+	got4, _ := RecoverVoucherSigner(v, big.NewInt(1), vc, sig)
+	require.NotEqual(t, addr, got4)
+}
+
+func TestProofSignRecoverRoundTrip(t *testing.T) {
+	key, _ := crypto.GenerateKey()
+	priv := crypto.FromECDSA(key)
+	addr := crypto.PubkeyToAddress(key.PublicKey)
+	chainID := big.NewInt(314159)
+	vc := common.HexToAddress("0x00000000000000000000000000000000000000AA")
+
+	p := RetrievalProof{Scope: 42, Resource: "bafkzcibxyz", Deadline: 9999}
+	sig, err := SignProof(p, chainID, vc, priv)
+	require.NoError(t, err)
+	got, err := RecoverProofSigner(p, chainID, vc, sig)
+	require.NoError(t, err)
+	require.Equal(t, addr, got)
+
+	p2 := p
+	p2.Resource = "bafkzcibother"
+	got2, _ := RecoverProofSigner(p2, chainID, vc, sig)
+	require.NotEqual(t, addr, got2, "resource binding")
+}
diff --git a/market/retrieval/gate/http_test.go b/market/retrieval/gate/http_test.go
new file mode 100644
index 000000000..5aba39d6f
--- /dev/null
+++ b/market/retrieval/gate/http_test.go
@@ -0,0 +1,218 @@
+package gate
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/crypto"
+	"github.com/ipfs/go-cid"
+	"github.com/multiformats/go-multihash"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeBackend struct {
+	datasets map[string][]uint64
+	content  map[string][]uint64
+	private  map[uint64]bool
+	payer    map[uint64]common.Address
+	chainID  *big.Int
+	vc       common.Address
+}
+
+func (f *fakeBackend) PieceDatasets(_ context.Context, c cid.Cid) ([]uint64, error)   { return f.datasets[c.String()], nil }
+func (f *fakeBackend) ContentDatasets(_ context.Context, c cid.Cid) ([]uint64, error) { return f.content[c.String()], nil }
+func (f *fakeBackend) DatasetPrivate(_ context.Context, id uint64) (bool, error)      { return f.private[id], nil }
+func (f *fakeBackend) DatasetPayer(_ context.Context, id uint64) (common.Address, error) {
+	return f.payer[id], nil
+}
+func (f *fakeBackend) ChainID(context.Context) (*big.Int, error)              { return f.chainID, nil }
+func (f *fakeBackend) VerifyingContract(context.Context) (common.Address, error) { return f.vc, nil }
+
+func pieceStub() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Gated", fmt.Sprintf("%v", IsGated(r.Context())))
+		_, _ = w.Write([]byte("PIECEBYTES"))
+	})
+}
+
+func mustCID(t *testing.T, s string) cid.Cid {
+	t.Helper()
+	c, err := cid.Parse(s)
+	require.NoError(t, err)
+	return c
+}
+
+func hashCID(t *testing.T, seed string) cid.Cid {
+	t.Helper()
+	h, err := multihash.Sum([]byte(seed), multihash.SHA2_256, -1)
+	require.NoError(t, err)
+	return cid.NewCidV1(cid.Raw, h)
+}
+
+func TestRetrievalGateHTTP(t *testing.T) {
+	const chainID = 314159
+	const privateSet, publicSet = uint64(10), uint64(20)
+
+	payerKey, _ := crypto.GenerateKey()
+	payerPriv, payerAddr := crypto.FromECDSA(payerKey), crypto.PubkeyToAddress(payerKey.PublicKey)
+	delegKey, _ := crypto.GenerateKey()
+	delegPriv, delegAddr := crypto.FromECDSA(delegKey), crypto.PubkeyToAddress(delegKey.PublicKey)
+	otherKey, _ := crypto.GenerateKey()
+	otherPriv := crypto.FromECDSA(otherKey)
+
+	privCID := mustCID(t, "bafkzcibcmqcnolmx4nc6b24hrjpbwmvosz7p53bzudwomdquxxmwr2yjhtu52pi")
+	pubCID := mustCID(t, "bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3oclgtqy55fbzdi")
+	unknownCID := mustCID(t, "bafybeihdwdcefgh4dqkjv67uzcmw7ojee6xedzdetojuzjevtenxquvyku")
+	privContentCID := hashCID(t, "priv-content")
+	pubContentCID := hashCID(t, "pub-content")
+
+	vc := common.HexToAddress("0x00000000000000000000000000000000000000AA")
+	backend := &fakeBackend{
+		datasets: map[string][]uint64{privCID.String(): {privateSet}, pubCID.String(): {privateSet, publicSet}},
+		content:  map[string][]uint64{privContentCID.String(): {privateSet}, pubContentCID.String(): {privateSet, publicSet}},
+		private:  map[uint64]bool{privateSet: true, publicSet: false},
+		payer:    map[uint64]common.Address{privateSet: payerAddr, publicSet: payerAddr},
+		chainID:  big.NewInt(chainID),
+		vc:       vc,
+	}
+
+	now := time.Now().Unix()
+	freshVoucher := func(grantee common.Address) *RetrievalVoucher {
+		return &RetrievalVoucher{Grantee: grantee, Scope: privateSet, IssuedAt: now - 10, Deadline: now + 3600}
+	}
+	// mkCred: proof over (scope, resource, proofDeadline) signed by proofPriv; optional voucher by voucherPriv.
+	mkCred := func(resource string, proofDeadline int64, proofPriv []byte, voucher *RetrievalVoucher, voucherPriv []byte) string {
+		p := RetrievalProof{Scope: privateSet, Resource: resource, Deadline: proofDeadline}
+		psig, err := SignProof(p, big.NewInt(chainID), vc, proofPriv)
+		require.NoError(t, err)
+		var vsig []byte
+		if voucher != nil {
+			vsig, err = SignVoucher(*voucher, big.NewInt(chainID), vc, voucherPriv)
+			require.NoError(t, err)
+		}
+		return EncodeCredential(SchemeEIP712, p, psig, voucher, vsig)
+	}
+	hdr := func(tok string) map[string]string { return map[string]string{"Authorization": AuthHeaderScheme + " " + tok} }
+
+	newServer := func(enabled bool) *httptest.Server {
+		return httptest.NewServer(NewMiddleware(enabled, "/piece/", backend).Handler(pieceStub()))
+	}
+	do := func(t *testing.T, srv *httptest.Server, path string, h map[string]string) (int, string, http.Header) {
+		req, _ := http.NewRequest(http.MethodGet, srv.URL+path, nil)
+		for k, v := range h {
+			req.Header.Set(k, v)
+		}
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		b, _ := io.ReadAll(resp.Body)
+		return resp.StatusCode, string(b), resp.Header
+	}
+	privPath := "/piece/" + privCID.String()
+
+	t.Run("disabled gate passes through", func(t *testing.T) {
+		s := newServer(false)
+		defer s.Close()
+		code, _, _ := do(t, s, privPath, nil)
+		require.Equal(t, http.StatusOK, code)
+	})
+
+	srv := newServer(true)
+	defer srv.Close()
+
+	t.Run("unknown piece serves publicly", func(t *testing.T) {
+		code, _, _ := do(t, srv, "/piece/"+unknownCID.String(), nil)
+		require.Equal(t, http.StatusOK, code)
+	})
+	t.Run("public-wins serves without a credential", func(t *testing.T) {
+		code, _, h := do(t, srv, "/piece/"+pubCID.String(), nil)
+		require.Equal(t, http.StatusOK, code)
+		require.Equal(t, "false", h.Get("X-Gated"))
+	})
+	t.Run("no credential -> 401", func(t *testing.T) {
+		code, _, _ := do(t, srv, privPath, nil)
+		require.Equal(t, http.StatusUnauthorized, code)
+	})
+
+	// --- proof of possession ---
+	t.Run("payer-direct proof -> 200", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, payerPriv, nil, nil)
+		code, body, h := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusOK, code)
+		require.Equal(t, "PIECEBYTES", body)
+		require.Equal(t, "true", h.Get("X-Gated"))
+	})
+	t.Run("delegated: payer grant + grantee proof -> 200", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, delegPriv, freshVoucher(delegAddr), payerPriv)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusOK, code)
+	})
+	t.Run("payer-direct via ?auth= -> 200", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, payerPriv, nil, nil)
+		code, _, _ := do(t, srv, privPath+"?"+AuthQueryParam+"="+tok, nil)
+		require.Equal(t, http.StatusOK, code)
+	})
+
+	// --- the whole point: a token/grant WITHOUT a valid fresh proof is useless ---
+	t.Run("grantee grant but proof by a THIEF (not the grantee) -> 403", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, otherPriv, freshVoucher(delegAddr), payerPriv)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+	t.Run("delegate proof but NO grant -> 403", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, delegPriv, nil, nil)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+	t.Run("proof bound to a DIFFERENT resource -> 403 (stolen for another piece)", func(t *testing.T) {
+		tok := mkCred("bafkzcibwrongresource", now+120, payerPriv, nil, nil)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+	t.Run("expired proof -> 403", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now-60, payerPriv, nil, nil)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+	t.Run("proof expiry too far in the future -> 403", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+int64(maxProofTTL.Seconds())+120, payerPriv, nil, nil)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+	t.Run("grant signed by a NON-payer -> 403", func(t *testing.T) {
+		tok := mkCred(privCID.String(), now+120, delegPriv, freshVoucher(delegAddr), otherPriv)
+		code, _, _ := do(t, srv, privPath, hdr(tok))
+		require.Equal(t, http.StatusForbidden, code)
+	})
+
+	// --- /ipfs/ gateway (resource = the payload CID in the URL) ---
+	csrv := httptest.NewServer(NewContentMiddleware(true, "/ipfs/", backend).Handler(pieceStub()))
+	defer csrv.Close()
+	t.Run("ipfs public-wins -> 200", func(t *testing.T) {
+		code, _, _ := do(t, csrv, "/ipfs/"+pubContentCID.String(), nil)
+		require.Equal(t, http.StatusOK, code)
+	})
+	t.Run("ipfs private no cred -> 401", func(t *testing.T) {
+		code, _, _ := do(t, csrv, "/ipfs/"+privContentCID.String(), nil)
+		require.Equal(t, http.StatusUnauthorized, code)
+	})
+	t.Run("ipfs private payer proof -> 200", func(t *testing.T) {
+		tok := mkCred(privContentCID.String(), now+120, payerPriv, nil, nil)
+		code, _, _ := do(t, csrv, "/ipfs/"+privContentCID.String(), hdr(tok))
+		require.Equal(t, http.StatusOK, code)
+	})
+	t.Run("ipfs subpath under private root gated; proof over root CID authorizes", func(t *testing.T) {
+		code, _, _ := do(t, csrv, "/ipfs/"+privContentCID.String()+"/dir/file.png", nil)
+		require.Equal(t, http.StatusUnauthorized, code)
+		tok := mkCred(privContentCID.String(), now+120, payerPriv, nil, nil)
+		code2, _, _ := do(t, csrv, "/ipfs/"+privContentCID.String()+"/dir/file.png", hdr(tok))
+		require.Equal(t, http.StatusOK, code2)
+	})
+}
diff --git a/market/retrieval/gate/middleware.go b/market/retrieval/gate/middleware.go
new file mode 100644
index 000000000..b3582e544
--- /dev/null
+++ b/market/retrieval/gate/middleware.go
@@ -0,0 +1,265 @@
+package gate
+
+import (
+	"context"
+	"math/big"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ipfs/go-cid"
+	logging "github.com/ipfs/go-log/v2"
+
+	"golang.org/x/xerrors"
+)
+
+var log = logging.Logger("retrieval-gate")
+
+// maxProofTTL bounds how far in the future a proof's expiry may be, so a captured proof is only
+// replayable for a short window (stateless replay protection — no server-side nonce store).
+const maxProofTTL = 5 * time.Minute
+
+type ctxKey int
+
+const gatedKey ctxKey = iota
+
+// IsGated reports whether the current request passed retrieval-ACL gating, so the piece handler can
+// emit a private (non-shared-cacheable) Cache-Control instead of the public/immutable default.
+func IsGated(ctx context.Context) bool {
+	v, _ := ctx.Value(gatedKey).(bool)
+	return v
+}
+
+// Backend supplies the data-set facts the gate needs. The production implementation (*Resolver)
+// reads them from the DB and the FWSS view on-chain; tests inject a fake. Keeping this an interface
+// is what lets the middleware, handler, reader and HTTP server be integration-tested without a
+// deployed FWSS contract.
+type Backend interface {
+	// PieceDatasets returns the on-chain data set ids that contain the piece (may be empty).
+	PieceDatasets(ctx context.Context, pieceCid cid.Cid) ([]uint64, error)
+	// ContentDatasets returns the data set ids containing the piece(s) that hold a payload/IPLD CID
+	// (via the index) — used for the /ipfs/ gateway. May be empty.
+	ContentDatasets(ctx context.Context, contentCid cid.Cid) ([]uint64, error)
+	// DatasetPrivate reports whether the data set opted into gated retrieval.
+	DatasetPrivate(ctx context.Context, dataSetId uint64) (bool, error)
+	// DatasetPayer returns the data set's (scope's) on-chain owner/payer.
+	DatasetPayer(ctx context.Context, scope uint64) (common.Address, error)
+	// ChainID returns the EVM chain id for the EIP-712 domain.
+	ChainID(ctx context.Context) (*big.Int, error)
+	// VerifyingContract returns the EIP-712 domain's verifyingContract (the owning service contract).
+	VerifyingContract(ctx context.Context) (common.Address, error)
+}
+
+// Middleware enforces opt-in retrieval permissioning on content-addressed piece requests.
+//
+// Flow: resolve the data sets that contain the requested piece → if any is public, serve as today
+// (public-wins). If all are private, require a valid, unexpired, dataset-scoped credential whose
+// named data set contains the piece and whose signer is that data set's on-chain payer.
+type Middleware struct {
+	enabled bool
+	prefix  string // path prefix stripped to obtain the CID (e.g. "/piece/", "/ipfs/")
+	backend Backend
+	// resolveDatasets maps the request's CID to candidate data set ids. For /piece/ the CID is a
+	// piece CID (PieceDatasets); for /ipfs/ it is a payload CID resolved through the index
+	// (ContentDatasets).
+	resolveDatasets func(context.Context, cid.Cid) ([]uint64, error)
+}
+
+// NewMiddleware builds gating for the /piece/ endpoint (the CID is a piece CID). When enabled is
+// false it is a pass-through (retrieval stays fully public).
+func NewMiddleware(enabled bool, prefix string, backend Backend) *Middleware {
+	return &Middleware{enabled: enabled, prefix: prefix, backend: backend, resolveDatasets: backend.PieceDatasets}
+}
+
+// NewContentMiddleware builds gating for the /ipfs/ gateway (the CID is a payload/IPLD CID, resolved
+// to its piece(s) through the index). When enabled is false it is a pass-through.
+func NewContentMiddleware(enabled bool, prefix string, backend Backend) *Middleware {
+	return &Middleware{enabled: enabled, prefix: prefix, backend: backend, resolveDatasets: backend.ContentDatasets}
+}
+
+// Handler is the chi/net-http middleware.
+func (m *Middleware) Handler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !m.enabled {
+			next.ServeHTTP(w, r)
+			return
+		}
+		ctx := r.Context()
+
+		pieceCid, ok := m.parseCID(r)
+		if !ok {
+			next.ServeHTTP(w, r) // malformed path — let the handler produce its own 400
+			return
+		}
+
+		datasets, err := m.resolveDatasets(ctx, pieceCid)
+		if err != nil {
+			log.Warnw("resolve datasets for piece", "cid", pieceCid, "err", err)
+			http.Error(w, "retrieval authorization unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if len(datasets) == 0 {
+			next.ServeHTTP(w, r) // not a known PDP dataset piece (e.g. a market deal) — unchanged
+			return
+		}
+
+		// public-wins: any public data set containing the piece makes it publicly retrievable.
+		privateSets := make([]uint64, 0, len(datasets))
+		for _, id := range datasets {
+			priv, err := m.backend.DatasetPrivate(ctx, id)
+			if err != nil {
+				log.Warnw("dataset private check", "dataSetId", id, "err", err)
+				http.Error(w, "retrieval authorization unavailable", http.StatusServiceUnavailable)
+				return
+			}
+			if !priv {
+				next.ServeHTTP(w, r)
+				return
+			}
+			privateSets = append(privateSets, id)
+		}
+
+		// All containing data sets are private → require a credential.
+		token, ok := extractToken(r)
+		if !ok {
+			writeErr(w, http.StatusUnauthorized, "missing retrieval credential")
+			return
+		}
+		cred, err := ParseCredential(token)
+		if err != nil {
+			writeErr(w, http.StatusForbidden, "invalid retrieval credential")
+			return
+		}
+		chainID, err := m.backend.ChainID(ctx)
+		if err != nil {
+			log.Warnw("resolve chain id", "err", err)
+			http.Error(w, "retrieval authorization unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		vc, err := m.backend.VerifyingContract(ctx)
+		if err != nil {
+			log.Warnw("resolve verifying contract", "err", err)
+			http.Error(w, "retrieval authorization unavailable", http.StatusServiceUnavailable)
+			return
+		}
+		if err := m.authorize(ctx, cred, chainID, vc, privateSets, pieceCid.String()); err != nil {
+			log.Debugw("retrieval denied", "cid", pieceCid, "err", err)
+			writeErr(w, http.StatusForbidden, "not authorized to retrieve this piece")
+			return
+		}
+
+		next.ServeHTTP(w, r.WithContext(context.WithValue(ctx, gatedKey, true)))
+	})
+}
+
+// authorize enforces capability + proof-of-possession. Every request carries a FRESH proof signed
+// by the requester's key, bound to the exact resource CID; the grant token alone is never enough.
+//
+//	payer-direct : proof signer == the data set's on-chain payer.
+//	delegated    : proof signer == grant.grantee AND the grant is payer-signed for the same data set.
+func (m *Middleware) authorize(ctx context.Context, cred *Credential, chainID *big.Int, vc common.Address, privateSets []uint64, resource string) error {
+	if cred.Scheme != SchemeEIP712 {
+		return xerrors.Errorf("unsupported scheme %q", cred.Scheme)
+	}
+	now := time.Now().Unix()
+	p := cred.Proof
+
+	// The proof must bind THIS request: the exact resource CID and a near-future deadline.
+	if p.Resource != resource {
+		return xerrors.New("proof is not bound to the requested resource")
+	}
+	if p.Deadline <= now {
+		return xerrors.New("proof expired")
+	}
+	if p.Deadline-now > int64(maxProofTTL.Seconds()) {
+		return xerrors.New("proof deadline too far in the future")
+	}
+	// The proof's scope must be one of the (private) scopes containing the piece.
+	if !containsUint64(privateSets, p.Scope) {
+		return xerrors.New("proof scope does not contain this piece")
+	}
+
+	requester, err := RecoverProofSigner(p, chainID, vc, cred.ProofSig)
+	if err != nil {
+		return xerrors.Errorf("recover proof signer: %w", err)
+	}
+	owner, err := m.backend.DatasetPayer(ctx, p.Scope)
+	if err != nil {
+		return xerrors.Errorf("resolve owner: %w", err)
+	}
+
+	// Owner proving their own access — no voucher needed.
+	if requester == owner {
+		return nil
+	}
+
+	// Otherwise the requester must be a grantee the owner delegated to via a voucher.
+	v := cred.Voucher
+	if v == nil {
+		return xerrors.New("proof signer is not the owner and no voucher was presented")
+	}
+	if v.Scope != p.Scope {
+		return xerrors.New("voucher is for a different scope than the proof")
+	}
+	if v.Deadline <= now {
+		return xerrors.New("voucher expired")
+	}
+	if v.Grantee != requester {
+		return xerrors.New("proof was not signed by the voucher's grantee")
+	}
+	issuer, err := RecoverVoucherSigner(*v, chainID, vc, cred.VoucherSig)
+	if err != nil {
+		return xerrors.Errorf("recover voucher issuer: %w", err)
+	}
+	if issuer != owner {
+		return xerrors.New("voucher was not signed by the scope owner")
+	}
+	return nil
+}
+
+func (m *Middleware) parseCID(r *http.Request) (cid.Cid, bool) {
+	if len(r.URL.Path) <= len(m.prefix) {
+		return cid.Undef, false
+	}
+	rest := r.URL.Path[len(m.prefix):]
+	// The IPFS gateway path is /ipfs/{cid}[/sub/path]; take only the first segment.
+	if i := strings.IndexByte(rest, '/'); i >= 0 {
+		rest = rest[:i]
+	}
+	c, err := cid.Parse(rest)
+	if err != nil {
+		return cid.Undef, false
+	}
+	return c, true
+}
+
+// extractToken returns the credential token from the Authorization header
+// ("CurioRetrieval <token>") or the ?auth= query parameter, in that order.
+func extractToken(r *http.Request) (string, bool) {
+	if h := r.Header.Get("Authorization"); h != "" {
+		if rest, ok := strings.CutPrefix(h, AuthHeaderScheme+" "); ok {
+			if t := strings.TrimSpace(rest); t != "" {
+				return t, true
+			}
+		}
+	}
+	if t := strings.TrimSpace(r.URL.Query().Get(AuthQueryParam)); t != "" {
+		return t, true
+	}
+	return "", false
+}
+
+func writeErr(w http.ResponseWriter, code int, msg string) {
+	w.Header().Set("Cache-Control", "no-store")
+	http.Error(w, msg, code)
+}
+
+func containsUint64(s []uint64, v uint64) bool {
+	for _, x := range s {
+		if x == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/market/retrieval/gate/resolve.go b/market/retrieval/gate/resolve.go
new file mode 100644
index 000000000..00e11849b
--- /dev/null
+++ b/market/retrieval/gate/resolve.go
@@ -0,0 +1,266 @@
+// Package gate implements opt-in permissioning for PDP piece retrieval.
+//
+// Retrieval is content-addressed (a request carries only a PieceCID) and a PieceCID can belong to
+// many data sets, each with its own payer. This package resolves the candidate data sets for a
+// requested piece, reads each data set's on-chain "private retrieval" opt-in flag, and resolves the
+// data set's on-chain payer — the identity that always has retrieval access and that signs
+// off-chain vouchers granting access to others.
+package gate
+
+import (
+	"context"
+	"math/big"
+	"sync"
+	"time"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ipfs/go-cid"
+	"golang.org/x/xerrors"
+
+	commcid "github.com/filecoin-project/go-fil-commcid"
+
+	"github.com/filecoin-project/curio/harmony/harmonydb"
+	"github.com/filecoin-project/curio/lib/commcidv2"
+	"github.com/filecoin-project/curio/lib/ethchain"
+	"github.com/filecoin-project/curio/market/indexstore"
+	"github.com/filecoin-project/curio/pdp/contract"
+	FWSS "github.com/filecoin-project/curio/pdp/contract/FWSS"
+)
+
+// RetrievalACLMetadataKey is the on-chain data-set metadata key a payer sets (at data set creation,
+// via the client SDK's EnhancedDataSetInfo.metadata) to opt the data set into gated retrieval.
+const RetrievalACLMetadataKey = "withRetrievalACL"
+
+// metadataCacheTTL bounds how long a data set's resolved private flag / payer is cached. Data set
+// metadata is set at creation and rarely changes, so a modest TTL keeps per-request eth_calls off
+// the hot path without going stale for long.
+const metadataCacheTTL = 5 * time.Minute
+
+// PieceDatasets returns the distinct on-chain data set ids that contain the requested piece, across
+// both PDP subsystems (mk20 `pdp_dataset_piece` keyed by piece_cid_v2, and pdpv0 `pdp_piecerefs` →
+// `pdp_data_set_pieces` keyed by the piece CID v1). The request CID may be v1 or v2; we match mk20
+// on the v2 form and pdpv0 on the v1 form (deriving v1 from v2 the same way the retrieval reader
+// does). An empty result means no known data set contains the piece.
+func PieceDatasets(ctx context.Context, db *harmonydb.DB, pieceCid cid.Cid) ([]uint64, error) {
+	v1 := pieceCid
+	if commcidv2.IsPieceCidV2(pieceCid) {
+		conv, _, err := commcid.PieceCidV1FromV2(pieceCid)
+		if err != nil {
+			return nil, xerrors.Errorf("piece CID v1 from v2: %w", err)
+		}
+		v1 = conv
+	}
+
+	seen := make(map[uint64]struct{})
+	var out []uint64
+	add := func(ids []uint64) {
+		for _, id := range ids {
+			if _, ok := seen[id]; !ok {
+				seen[id] = struct{}{}
+				out = append(out, id)
+			}
+		}
+	}
+
+	// mk20 subsystem: piece stored by v2 CID.
+	var mk20 []uint64
+	if err := db.Select(ctx, &mk20, `
+		SELECT DISTINCT data_set_id
+		FROM pdp_dataset_piece
+		WHERE piece_cid_v2 = $1 AND removed = FALSE`, pieceCid.String()); err != nil {
+		return nil, xerrors.Errorf("querying mk20 pdp_dataset_piece: %w", err)
+	}
+	add(mk20)
+
+	// pdpv0 subsystem: pieceref keyed by v1 CID, joined to its data sets.
+	var pdpv0 []uint64
+	if err := db.Select(ctx, &pdpv0, `
+		SELECT DISTINCT dsp.data_set
+		FROM pdp_piecerefs pr
+		JOIN pdp_data_set_pieces dsp ON dsp.pdp_pieceref = pr.id
+		WHERE pr.piece_cid = $1`, v1.String()); err != nil {
+		return nil, xerrors.Errorf("querying pdpv0 pdp_piecerefs: %w", err)
+	}
+	add(pdpv0)
+
+	return out, nil
+}
+
+// Resolver answers "is this data set private?" and "who is its payer?" against the FWSS view,
+// caching both per data set for metadataCacheTTL. It is safe for concurrent use.
+type Resolver struct {
+	db  *harmonydb.DB
+	idx *indexstore.IndexStore
+	eth func(context.Context) (ethchain.EthClient, error)
+
+	mu      sync.Mutex
+	private map[uint64]cachedBool
+	payer   map[uint64]cachedAddr
+	chainID *big.Int
+	vc      *common.Address // cached EIP-712 verifyingContract (the FWSS service address)
+}
+
+// VerifyingContract implements Backend: the EIP-712 domain's verifyingContract for PDP scopes — the
+// FWSS service contract. Provides cross-service domain separation (see RETRIEVAL-AUTH-SPEC.md §3).
+func (r *Resolver) VerifyingContract(ctx context.Context) (common.Address, error) {
+	r.mu.Lock()
+	if r.vc != nil {
+		v := *r.vc
+		r.mu.Unlock()
+		return v, nil
+	}
+	r.mu.Unlock()
+
+	addr := contract.ContractAddresses().AllowedPublicRecordKeepers.FWSService
+	if addr == (common.Address{}) {
+		return common.Address{}, xerrors.New("FWSS service address not configured")
+	}
+	r.mu.Lock()
+	r.vc = &addr
+	r.mu.Unlock()
+	return addr, nil
+}
+
+// PieceDatasets implements Backend: the candidate data sets containing the piece.
+func (r *Resolver) PieceDatasets(ctx context.Context, pieceCid cid.Cid) ([]uint64, error) {
+	return PieceDatasets(ctx, r.db, pieceCid)
+}
+
+// ContentDatasets implements Backend for the IPFS gateway: it maps a payload/IPLD CID to the
+// piece(s) that contain it (via the index) and unions their data sets. Content that is not indexed
+// to any piece resolves to no data sets (served publicly / 404'd by the gateway as before).
+func (r *Resolver) ContentDatasets(ctx context.Context, contentCid cid.Cid) ([]uint64, error) {
+	if r.idx == nil {
+		return nil, xerrors.New("index store not configured")
+	}
+	pieces, err := r.idx.PiecesContainingMultihash(ctx, contentCid.Hash())
+	if err != nil {
+		return nil, xerrors.Errorf("index lookup for %s: %w", contentCid, err)
+	}
+	seen := make(map[uint64]struct{})
+	var out []uint64
+	for _, p := range pieces {
+		ids, err := PieceDatasets(ctx, r.db, p.PieceCid)
+		if err != nil {
+			return nil, err
+		}
+		for _, id := range ids {
+			if _, ok := seen[id]; !ok {
+				seen[id] = struct{}{}
+				out = append(out, id)
+			}
+		}
+	}
+	return out, nil
+}
+
+// ChainID implements Backend: the EVM chain id, fetched once and cached.
+func (r *Resolver) ChainID(ctx context.Context) (*big.Int, error) {
+	r.mu.Lock()
+	if r.chainID != nil {
+		id := r.chainID
+		r.mu.Unlock()
+		return id, nil
+	}
+	r.mu.Unlock()
+
+	eth, err := r.eth(ctx)
+	if err != nil {
+		return nil, xerrors.Errorf("eth client: %w", err)
+	}
+	id, err := eth.ChainID(ctx)
+	if err != nil {
+		return nil, xerrors.Errorf("eth ChainID: %w", err)
+	}
+	r.mu.Lock()
+	r.chainID = id
+	r.mu.Unlock()
+	return id, nil
+}
+
+type cachedBool struct {
+	v   bool
+	exp time.Time
+}
+
+type cachedAddr struct {
+	v   common.Address
+	exp time.Time
+}
+
+// NewResolver builds a Resolver. eth is a getter (the retrieval provider holds a lazily-initialized
+// eth client) so we only dial the node when a gated request actually needs it. idx may be nil if the
+// IPFS gateway is not gated.
+func NewResolver(db *harmonydb.DB, idx *indexstore.IndexStore, eth func(context.Context) (ethchain.EthClient, error)) *Resolver {
+	return &Resolver{
+		db:      db,
+		idx:     idx,
+		eth:     eth,
+		private: make(map[uint64]cachedBool),
+		payer:   make(map[uint64]cachedAddr),
+	}
+}
+
+// DatasetPrivate reports whether the data set opted into gated retrieval (the RetrievalACLMetadataKey
+// on-chain metadata flag is set). Result is cached per data set.
+func (r *Resolver) DatasetPrivate(ctx context.Context, dataSetId uint64) (bool, error) {
+	now := time.Now()
+	r.mu.Lock()
+	if c, ok := r.private[dataSetId]; ok && now.Before(c.exp) {
+		r.mu.Unlock()
+		return c.v, nil
+	}
+	r.mu.Unlock()
+
+	eth, err := r.eth(ctx)
+	if err != nil {
+		return false, xerrors.Errorf("eth client: %w", err)
+	}
+	pdpVerifier, err := contract.NewPDPVerifierCaller(contract.ContractAddresses().PDPVerifier, eth)
+	if err != nil {
+		return false, xerrors.Errorf("instantiate PDPVerifier: %w", err)
+	}
+	setID := new(big.Int).SetUint64(dataSetId)
+	listenerAddr, err := pdpVerifier.GetDataSetListener(contract.EthCallOpts(ctx), setID)
+	if err != nil {
+		return false, xerrors.Errorf("GetDataSetListener(%d): %w", dataSetId, err)
+	}
+	private, _, err := contract.GetDataSetMetadataAtKey(ctx, listenerAddr, eth, setID, RetrievalACLMetadataKey)
+	if err != nil {
+		return false, xerrors.Errorf("GetDataSetMetadataAtKey(%d, %s): %w", dataSetId, RetrievalACLMetadataKey, err)
+	}
+
+	r.mu.Lock()
+	r.private[dataSetId] = cachedBool{v: private, exp: now.Add(metadataCacheTTL)}
+	r.mu.Unlock()
+	return private, nil
+}
+
+// DatasetPayer returns the data set's on-chain payer (the FWSS view's GetDataSet().Payer). Result is
+// cached per data set.
+func (r *Resolver) DatasetPayer(ctx context.Context, dataSetId uint64) (common.Address, error) {
+	if dataSetId == 0 {
+		return common.Address{}, xerrors.New("dataSetId must be greater than 0")
+	}
+	now := time.Now()
+	r.mu.Lock()
+	if c, ok := r.payer[dataSetId]; ok && now.Before(c.exp) {
+		r.mu.Unlock()
+		return c.v, nil
+	}
+	r.mu.Unlock()
+
+	eth, err := r.eth(ctx)
+	if err != nil {
+		return common.Address{}, xerrors.Errorf("eth client: %w", err)
+	}
+	payer, err := FWSS.DataSetPayer(ctx, eth, dataSetId)
+	if err != nil {
+		return common.Address{}, err
+	}
+
+	r.mu.Lock()
+	r.payer[dataSetId] = cachedAddr{v: payer, exp: now.Add(metadataCacheTTL)}
+	r.mu.Unlock()
+	return payer, nil
+}
diff --git a/market/retrieval/gate/scheme.go b/market/retrieval/gate/scheme.go
new file mode 100644
index 000000000..09d1827ad
--- /dev/null
+++ b/market/retrieval/gate/scheme.go
@@ -0,0 +1,144 @@
+package gate
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strconv"
+	"strings"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/common/hexutil"
+
+	"golang.org/x/xerrors"
+)
+
+// Credential presentation (see RETRIEVAL-AUTH-SPEC.md §6):
+//   Authorization: CurioRetrieval <token>      (SDK / server / browser fetch / headless agent)
+//   ?auth=<token>                              (header-less browser tags)
+// where <token> = base64url(JSON) carrying a fresh proof and (for delegated access) the voucher.
+// uint256 fields are decimal STRINGS; addresses/signatures are 0x-hex; resource is the CID string.
+const (
+	AuthHeaderScheme = "CurioRetrieval"
+	AuthQueryParam   = "auth"
+	SchemeEIP712     = "eip712"
+)
+
+type wireVoucher struct {
+	Grantee  string `json:"grantee"`
+	Scope    string `json:"scope"`
+	IssuedAt string `json:"issuedAt"`
+	Deadline string `json:"deadline"`
+}
+
+type wireProof struct {
+	Scope    string `json:"scope"`
+	Resource string `json:"resource"`
+	Deadline string `json:"deadline"`
+}
+
+type wireCredential struct {
+	Scheme     string       `json:"scheme"`
+	Proof      wireProof    `json:"proof"`
+	ProofSig   string       `json:"proofSig"`
+	Voucher    *wireVoucher `json:"voucher,omitempty"`    // omitted for owner-direct access
+	VoucherSig string       `json:"voucherSig,omitempty"` // "" for owner-direct access
+}
+
+// Credential is a parsed, not-yet-verified retrieval credential.
+type Credential struct {
+	Scheme     string
+	Proof      RetrievalProof
+	ProofSig   []byte
+	Voucher    *RetrievalVoucher // nil ⇒ owner-direct (the proof signer must itself be the owner)
+	VoucherSig []byte
+}
+
+func atoiU(s string) (uint64, error) { return strconv.ParseUint(s, 10, 64) }
+func atoiI(s string) (int64, error)  { return strconv.ParseInt(s, 10, 64) }
+
+// ParseCredential decodes a base64url(JSON) token (signatures not yet checked).
+func ParseCredential(token string) (*Credential, error) {
+	token = strings.TrimSpace(token)
+	raw, err := base64.RawURLEncoding.DecodeString(token)
+	if err != nil {
+		if raw, err = base64.URLEncoding.DecodeString(token); err != nil {
+			return nil, xerrors.Errorf("decode credential token: %w", err)
+		}
+	}
+	var wc wireCredential
+	if err := json.Unmarshal(raw, &wc); err != nil {
+		return nil, xerrors.Errorf("unmarshal credential: %w", err)
+	}
+
+	pScope, err := atoiU(wc.Proof.Scope)
+	if err != nil {
+		return nil, xerrors.Errorf("proof scope: %w", err)
+	}
+	pDeadline, err := atoiI(wc.Proof.Deadline)
+	if err != nil {
+		return nil, xerrors.Errorf("proof deadline: %w", err)
+	}
+	proofSig, err := hexutil.Decode(wc.ProofSig)
+	if err != nil {
+		return nil, xerrors.Errorf("decode proof signature: %w", err)
+	}
+	cred := &Credential{
+		Scheme:   wc.Scheme,
+		Proof:    RetrievalProof{Scope: pScope, Resource: wc.Proof.Resource, Deadline: pDeadline},
+		ProofSig: proofSig,
+	}
+
+	if wc.Voucher != nil {
+		if !common.IsHexAddress(wc.Voucher.Grantee) {
+			return nil, xerrors.New("invalid grantee address")
+		}
+		vScope, err := atoiU(wc.Voucher.Scope)
+		if err != nil {
+			return nil, xerrors.Errorf("voucher scope: %w", err)
+		}
+		vIssuedAt, err := atoiI(wc.Voucher.IssuedAt)
+		if err != nil {
+			return nil, xerrors.Errorf("voucher issuedAt: %w", err)
+		}
+		vDeadline, err := atoiI(wc.Voucher.Deadline)
+		if err != nil {
+			return nil, xerrors.Errorf("voucher deadline: %w", err)
+		}
+		vs, err := hexutil.Decode(wc.VoucherSig)
+		if err != nil {
+			return nil, xerrors.Errorf("decode voucher signature: %w", err)
+		}
+		cred.Voucher = &RetrievalVoucher{
+			Grantee:  common.HexToAddress(wc.Voucher.Grantee),
+			Scope:    vScope,
+			IssuedAt: vIssuedAt,
+			Deadline: vDeadline,
+		}
+		cred.VoucherSig = vs
+	}
+	return cred, nil
+}
+
+// EncodeCredential builds the base64url token a client presents (reference client / tests).
+func EncodeCredential(scheme string, p RetrievalProof, proofSig []byte, v *RetrievalVoucher, voucherSig []byte) string {
+	wc := wireCredential{
+		Scheme: scheme,
+		Proof: wireProof{
+			Scope:    strconv.FormatUint(p.Scope, 10),
+			Resource: p.Resource,
+			Deadline: strconv.FormatInt(p.Deadline, 10),
+		},
+		ProofSig: hexutil.Encode(proofSig),
+	}
+	if v != nil {
+		wc.Voucher = &wireVoucher{
+			Grantee:  v.Grantee.Hex(),
+			Scope:    strconv.FormatUint(v.Scope, 10),
+			IssuedAt: strconv.FormatInt(v.IssuedAt, 10),
+			Deadline: strconv.FormatInt(v.Deadline, 10),
+		}
+		wc.VoucherSig = hexutil.Encode(voucherSig)
+	}
+	b, _ := json.Marshal(wc)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
diff --git a/market/retrieval/gate/scheme_test.go b/market/retrieval/gate/scheme_test.go
new file mode 100644
index 000000000..186f52a12
--- /dev/null
+++ b/market/retrieval/gate/scheme_test.go
@@ -0,0 +1,74 @@
+package gate
+
+import (
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/crypto"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCredentialRoundTrip(t *testing.T) {
+	ownerKey, _ := crypto.GenerateKey()
+	granteeKey, _ := crypto.GenerateKey()
+	owner := crypto.PubkeyToAddress(ownerKey.PublicKey)
+	grantee := crypto.PubkeyToAddress(granteeKey.PublicKey)
+	chainID := big.NewInt(314159)
+	vc := common.HexToAddress("0x00000000000000000000000000000000000000AA")
+
+	p := RetrievalProof{Scope: 9, Resource: "bafkzcibxyz", Deadline: 1234}
+	psig, err := SignProof(p, chainID, vc, crypto.FromECDSA(granteeKey))
+	require.NoError(t, err)
+	v := RetrievalVoucher{Grantee: grantee, Scope: 9, IssuedAt: 100, Deadline: 200}
+	vsig, err := SignVoucher(v, chainID, vc, crypto.FromECDSA(ownerKey))
+	require.NoError(t, err)
+
+	// delegated (voucher present)
+	tok := EncodeCredential(SchemeEIP712, p, psig, &v, vsig)
+	cred, err := ParseCredential(tok)
+	require.NoError(t, err)
+	require.Equal(t, SchemeEIP712, cred.Scheme)
+	require.Equal(t, p, cred.Proof)
+	require.NotNil(t, cred.Voucher)
+	require.Equal(t, v, *cred.Voucher)
+	rp, _ := RecoverProofSigner(cred.Proof, chainID, vc, cred.ProofSig)
+	require.Equal(t, grantee, rp)
+	ri, _ := RecoverVoucherSigner(*cred.Voucher, chainID, vc, cred.VoucherSig)
+	require.Equal(t, owner, ri)
+
+	// owner-direct (no voucher)
+	cred2, err := ParseCredential(EncodeCredential(SchemeEIP712, p, psig, nil, nil))
+	require.NoError(t, err)
+	require.Nil(t, cred2.Voucher)
+}
+
+func TestParseCredentialRejectsGarbage(t *testing.T) {
+	_, err := ParseCredential("not-base64!!")
+	require.Error(t, err)
+}
+
+func TestExtractToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/piece/bafy", nil)
+	r.Header.Set("Authorization", AuthHeaderScheme+" abc123")
+	tok, ok := extractToken(r)
+	require.True(t, ok)
+	require.Equal(t, "abc123", tok)
+
+	r2 := httptest.NewRequest(http.MethodGet, "/piece/bafy?"+AuthQueryParam+"=xyz789", nil)
+	tok2, ok := extractToken(r2)
+	require.True(t, ok)
+	require.Equal(t, "xyz789", tok2)
+
+	r3 := httptest.NewRequest(http.MethodGet, "/piece/bafy?"+AuthQueryParam+"=fromquery", nil)
+	r3.Header.Set("Authorization", AuthHeaderScheme+" fromheader")
+	tok3, _ := extractToken(r3)
+	require.Equal(t, "fromheader", tok3)
+
+	r5 := httptest.NewRequest(http.MethodGet, "/piece/bafy", nil)
+	r5.Header.Set("Authorization", "Bearer sometoken")
+	_, ok5 := extractToken(r5)
+	require.False(t, ok5)
+}
diff --git a/market/retrieval/piecehandler.go b/market/retrieval/piecehandler.go
index 01cbd12dd..17df6199d 100644
--- a/market/retrieval/piecehandler.go
+++ b/market/retrieval/piecehandler.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/filecoin-project/curio/lib/cachedreader"
 	"github.com/filecoin-project/curio/lib/pieceprovider"
+	"github.com/filecoin-project/curio/market/retrieval/gate"
 	"github.com/filecoin-project/curio/market/retrieval/remoteblockstore"
 )
 
@@ -77,7 +78,7 @@ func (rp *Provider) handleByPieceCid(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	setHeaders(w, pieceCid, contentType)
+	setHeaders(w, pieceCid, contentType, gate.IsGated(ctx))
 
 	// Let's try to serve the original data without padding
 	sr := io.NewSectionReader(reader, 0, int64(rawSize))
@@ -100,9 +101,14 @@ func sniffContentType(r io.ReaderAt) (string, error) {
 	return http.DetectContentType(buf[:n]), nil
 }
 
-func setHeaders(w http.ResponseWriter, pieceCid cid.Cid, contentType string) {
+func setHeaders(w http.ResponseWriter, pieceCid cid.Cid, contentType string, gated bool) {
 	w.Header().Set("Vary", "Accept-Encoding")
-	w.Header().Set("Cache-Control", "public, max-age=29030400, immutable")
+	if gated {
+		// Authorization-gated content must not be stored by shared caches/CDNs.
+		w.Header().Set("Cache-Control", "private, no-store")
+	} else {
+		w.Header().Set("Cache-Control", "public, max-age=29030400, immutable")
+	}
 	w.Header().Set("Content-Type", contentType)
 	if contentType != "application/octet-stream" {
 		if exts, err := mime.ExtensionsByType(contentType); err == nil && len(exts) > 0 {
diff --git a/market/retrieval/piecehandler_test.go b/market/retrieval/piecehandler_test.go
index b2eeccb90..dd3eab3ab 100644
--- a/market/retrieval/piecehandler_test.go
+++ b/market/retrieval/piecehandler_test.go
@@ -90,7 +90,13 @@ func TestSetHeadersWritesQuotedETag(t *testing.T) {
 	require.NoError(t, err)
 
 	w := httptest.NewRecorder()
-	setHeaders(w, pieceCid, "video/mp4")
+	setHeaders(w, pieceCid, "video/mp4", false)
 
 	require.Equal(t, `"`+pieceCid.String()+`"`, w.Header().Get("ETag"))
+	require.Equal(t, "public, max-age=29030400, immutable", w.Header().Get("Cache-Control"))
+
+	// Gated responses must not be shared-cacheable.
+	wg := httptest.NewRecorder()
+	setHeaders(wg, pieceCid, "video/mp4", true)
+	require.Equal(t, "private, no-store", wg.Header().Get("Cache-Control"))
 }
diff --git a/market/retrieval/retrieval.go b/market/retrieval/retrieval.go
index b8e1dfd11..b7a7afc82 100644
--- a/market/retrieval/retrieval.go
+++ b/market/retrieval/retrieval.go
@@ -26,6 +26,7 @@ import (
 	"github.com/filecoin-project/curio/lib/cachedreader"
 	"github.com/filecoin-project/curio/market/denylist"
 	"github.com/filecoin-project/curio/market/indexstore"
+	"github.com/filecoin-project/curio/market/retrieval/gate"
 	"github.com/filecoin-project/curio/market/retrieval/remoteblockstore"
 
 	"github.com/filecoin-project/lotus/blockstore"
@@ -236,29 +237,38 @@ func metricsMiddleware(next http.Handler) http.Handler {
 	})
 }
 
-func Router(mux *chi.Mux, rp *Provider, df *denylist.Filter) {
+func Router(mux *chi.Mux, rp *Provider, df *denylist.Filter, pieceGate, ipfsGate *gate.Middleware) {
 	// Group retrieval routes with metrics middleware
 	mux.Group(func(r chi.Router) {
 		r.Use(metricsMiddleware)
 
-		// Piece endpoint with denylist and limiter
+		// Piece endpoint with denylist, limiter, and (opt-in) retrieval permissioning
 		r.Group(func(r chi.Router) {
 			r.Use(denylist.Middleware(df))
 			r.Use(limiterMiddleware(pieceRequestLimiter))
+			if pieceGate != nil {
+				r.Use(pieceGate.Handler)
+			}
 			r.Get(piecePrefix+"{cid}", rp.handleByPieceCid)
 			r.Head(piecePrefix+"{cid}", rp.handleByPieceCid)
 		})
 
-		// IPFS endpoints with denylist and limiter
+		// IPFS endpoints with denylist, limiter, and (opt-in) retrieval permissioning
 		r.Group(func(r chi.Router) {
 			r.Use(denylist.Middleware(df))
 			r.Use(limiterMiddleware(ipfsHeadRequestLimiter))
+			if ipfsGate != nil {
+				r.Use(ipfsGate.Handler)
+			}
 			r.Head(ipfsPrefix+"*", rp.fr.ServeHTTP)
 		})
 
 		r.Group(func(r chi.Router) {
 			r.Use(denylist.Middleware(df))
 			r.Use(limiterMiddleware(ipfsRequestLimiter))
+			if ipfsGate != nil {
+				r.Use(ipfsGate.Handler)
+			}
 			r.Get(ipfsPrefix+"*", rp.fr.ServeHTTP)
 		})
 
diff --git a/market/retrieval/retrieval_test.go b/market/retrieval/retrieval_test.go
index 40f29fd7d..51aa28762 100644
--- a/market/retrieval/retrieval_test.go
+++ b/market/retrieval/retrieval_test.go
@@ -72,7 +72,7 @@ func TestIPFSPathRouting(t *testing.T) {
 
 	// Set up router
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	testCases := []struct {
 		name         string
@@ -166,7 +166,7 @@ func TestRouterSetup(t *testing.T) {
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	// Test that non-IPFS routes work
 	req := httptest.NewRequest(http.MethodGet, "/info", nil)
@@ -207,7 +207,7 @@ func TestTrustlessGatewaySentinel(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	testCases := []struct {
 		name   string
@@ -273,7 +273,7 @@ func TestTrustlessGatewayHeaders(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	t.Run("CAR response headers", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodGet, "/ipfs/"+rootEnt.Root.String(), nil)
@@ -327,7 +327,7 @@ func TestTrustlessGatewayAcceptHeader(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	t.Run("Missing Accept header returns 400", func(t *testing.T) {
 		// Note that Frisbii will be forgiving about a wildcard Accept header,
@@ -383,7 +383,7 @@ func TestTrustlessGatewayQueryParameters(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	testCases := []struct {
 		name       string
@@ -484,7 +484,7 @@ func TestRawBlockRetrieval(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	// Test retrieval of each individual block
 	for i, c := range allCIDs {
@@ -548,7 +548,7 @@ func TestMissingBlockReturns404(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	// Create a CID that doesn't exist in the store
 	nonExistentCID := "bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3oclgtqy55fbzdi"
@@ -626,7 +626,7 @@ func TestDagScopeCAR(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	t.Run("dag-scope=block returns single block CAR", func(t *testing.T) {
 		req := httptest.NewRequest(http.MethodGet, "/ipfs/"+dirRootEnt.Root.String()+"?dag-scope=block", nil)
@@ -714,7 +714,7 @@ func TestPiecePathHeadRouting(t *testing.T) {
 
 	provider := NewRetrievalProviderWithLinkSystem(ctx, lsys, has)
 	mux := chi.NewMux()
-	Router(mux, provider, testDenyFilter())
+	Router(mux, provider, testDenyFilter(), nil, nil)
 
 	for _, method := range []string{http.MethodGet, http.MethodHead} {
 		rctx := chi.NewRouteContext()
diff --git a/pdp/contract/FWSS/payer.go b/pdp/contract/FWSS/payer.go
new file mode 100644
index 000000000..8a5d838fa
--- /dev/null
+++ b/pdp/contract/FWSS/payer.go
@@ -0,0 +1,38 @@
+package FWSS
+
+import (
+	"context"
+	"math/big"
+
+	"github.com/ethereum/go-ethereum/common"
+	"golang.org/x/xerrors"
+
+	"github.com/filecoin-project/curio/lib/ethchain"
+	"github.com/filecoin-project/curio/pdp/contract"
+)
+
+// DataSetPayer resolves a data set's on-chain payer via the FWSS state view. Shared by the PDP pull
+// validator (pdp.EthCallValidator) and the retrieval gate (market/retrieval/gate.Resolver) so the
+// FWSS-view round-trip lives in one place.
+func DataSetPayer(ctx context.Context, ethClient ethchain.EthClient, dataSetId uint64) (common.Address, error) {
+	if dataSetId == 0 {
+		return common.Address{}, xerrors.New("dataSetId must be greater than 0")
+	}
+	serviceAddr := contract.ContractAddresses().AllowedPublicRecordKeepers.FWSService
+	viewAddr, err := contract.ResolveViewAddress(ctx, serviceAddr, ethClient)
+	if err != nil {
+		return common.Address{}, xerrors.Errorf("resolve FWSS view address: %w", err)
+	}
+	view, err := NewFilecoinWarmStorageServiceStateView(viewAddr, ethClient)
+	if err != nil {
+		return common.Address{}, xerrors.Errorf("bind FWSS state view: %w", err)
+	}
+	ds, err := view.GetDataSet(contract.EthCallOpts(ctx), new(big.Int).SetUint64(dataSetId))
+	if err != nil {
+		return common.Address{}, xerrors.Errorf("get FWSS data set %d: %w", dataSetId, err)
+	}
+	if ds.Payer == (common.Address{}) {
+		return common.Address{}, xerrors.Errorf("data set %d payer is zero address", dataSetId)
+	}
+	return ds.Payer, nil
+}
diff --git a/pdp/handlers_pull.go b/pdp/handlers_pull.go
index 052b3074a..4784594c8 100644
--- a/pdp/handlers_pull.go
+++ b/pdp/handlers_pull.go
@@ -119,30 +119,7 @@ func (v *EthCallValidator) ValidateAddPieces(ctx context.Context, params *AddPie
 }
 
 func (v *EthCallValidator) GetDataSetPayer(ctx context.Context, dataSetId uint64) (common.Address, error) {
-	if dataSetId == 0 {
-		return common.Address{}, fmt.Errorf("dataSetId must be greater than 0")
-	}
-
-	serviceAddr := contract.ContractAddresses().AllowedPublicRecordKeepers.FWSService
-	viewAddr, err := contract.ResolveViewAddress(ctx, serviceAddr, v.ethClient)
-	if err != nil {
-		return common.Address{}, fmt.Errorf("resolve FWSS view address: %w", err)
-	}
-
-	fwssView, err := FWSS.NewFilecoinWarmStorageServiceStateView(viewAddr, v.ethClient)
-	if err != nil {
-		return common.Address{}, fmt.Errorf("bind FWSS state view: %w", err)
-	}
-
-	dataSet, err := fwssView.GetDataSet(contract.EthCallOpts(ctx), new(big.Int).SetUint64(dataSetId))
-	if err != nil {
-		return common.Address{}, fmt.Errorf("get FWSS data set %d: %w", dataSetId, err)
-	}
-	if dataSet.Payer == (common.Address{}) {
-		return common.Address{}, fmt.Errorf("data set %d payer is zero address", dataSetId)
-	}
-
-	return dataSet.Payer, nil
+	return FWSS.DataSetPayer(ctx, v.ethClient, dataSetId)
 }
 
 // PullHandler handles piece pull requests