Skip to main content

​
Scope

Wallet APIs manage user wallet registration, PIN validation, key export, and pricing helpers. Native custodial sends now sign on the server.

​
Endpoint map (in OpenAPI)

  • Wallet lifecycle: /api/wallets (GET/POST/DELETE)
  • Security flows: /api/wallets/set-pin, /api/wallets/verify-pin, /api/wallets/private-key
  • Prices: /api/wallets/coin-prices, /api/crypto-prices

​
Custodial signing

Prefer these over returning raw keys to the client:
  • POST /api/wallets/{address}/sign-transaction — PIN-gated server-side sign and send
  • POST /api/wallets/{address}/export — PIN-gated seed/recovery-phrase reveal
POST /api/wallets/private-key is deprecated in OpenAPI. It still requires a verified 6-digit PIN and remains only until native finishes migrating off it. New client work must call sign-transaction. Also in OpenAPI:
  • GET /api/wallets/link-challenge
  • POST /api/wallets/link-external
  • POST /api/wallets/reset-pin
  • GET /api/wallets/{address}/attestation — D-Sports-signed attestation JWS. The path parameter is named address, but the value is the wallet database id, not the on-chain address.
  • POST /api/pregen-wallet
  • POST /api/thirdweb-link
  • GET/POST /api/thirdweb-proxy

​
KYC (in OpenAPI)

Authenticated session helpers. These return status and short-lived Link tokens only. They do not expose vendor dashboard URLs or webhook secrets.
  • POST /api/v1/kyc/link-token
  • POST /api/v1/kyc/session/complete — accepts the local IdentityVerification id or Plaid’s identity_verification_id
  • GET /api/v1/user/kyc-status — status only. Lives under /api/v1/user, not marketplace.

​
Integration notes

  • Treat PIN, export, and sign operations as sensitive user actions.
  • Pair price lookup APIs with freshness indicators on the client side.
  • Native custodial create sends { pin, legalTermsVersion } only.
  • Import/link also requires pin, plus address and encryptedPrivateKey or privateKey.
  • DELETE /api/wallets needs { address, pin } for custodial wallets. External links need { address } only. Missing or wrong PIN returns 400 VALIDATION_ERROR.

​
Deep-dive documentation