Skip to main content

​
Main non-admin routes

  • GET /api/wallets
  • DELETE /api/wallets
  • POST /api/pregen-wallet
  • POST /api/wallets/set-pin
  • POST /api/wallets/verify-pin
  • POST /api/wallets/private-key (deprecated; PIN-gated)
  • POST /api/wallets/{address}/sign-transaction
  • POST /api/wallets/{address}/export
  • GET /api/wallets/{address}/attestation (path value is the wallet database id)
  • GET /api/wallets/coin-prices
  • GET /api/crypto-prices
  • POST /api/thirdweb-link
  • POST /api/thirdweb-proxy
  • POST /api/v1/kyc/link-token
  • POST /api/v1/kyc/session/complete
  • GET /api/v1/user/kyc-status

​
Runtime behavior highlights

  • Wallet routes return or provision user wallet context depending on prior state.
  • DELETE /api/wallets requires { address, pin } for custodial wallets and { address } only for external links. Missing or wrong PIN returns 400 VALIDATION_ERROR.
  • PIN routes establish and verify credential gates before private-key access.
  • Private-key access route is deprecated. New client work must call PIN-gated sign-transaction instead of fetching raw keys.
  • Coin/crypto price routes provide market data used by wallet and checkout experiences.
  • Provider proxy/link routes bridge client flow to external web3 integrations.
  • KYC helpers return status and short-lived Link tokens only. They do not expose vendor dashboard URLs or webhook secrets.

​
Side effects and dependencies

  • Wallet identity and session state link directly to user auth context.
  • Wallet flows are consumed by collectibles and crypto checkout paths.

​
Known caveats

  • External web3 provider behavior can introduce transient errors and retry requirements.
  • Security-sensitive flows depend on strict client sequencing (PIN set/verify before key retrieval).

​
Exclusions

  • Staff-only wallet debug or administrative override behavior is excluded.