API REFERENCE

Authentication

Exchange the client credentials issued during MTO onboarding for a short-lived API access token.

POST /api/token

Client credentials20 requests per minute

Request

Field	Type	Required	Description
`clientId`	string	Yes	Client ID for the environment you are calling.
`clientSecret`	string	Yes	Secret paired with that client ID.

bash

curl --request POST "${BASE_URL}/api/token" \
  --header "Content-Type: application/json" \
  --data '{
    "clientId": "your_client_id",
    "clientSecret": "your_client_secret"
  }'

Response

json

{
  "accessToken": "eyJhbGciOi...",
  "tokenType": "Bearer",
  "expiresIn": 3600
}

Send accessToken with each wallet and transfer request:

http

Authorization: Bearer eyJhbGciOi...

The token lasts one hour and cannot be refreshed. Cache it securely, then request another shortly before expiry. Do not request a fresh token for every API call.

Common errors

Status	Meaning
`401`	Credentials are invalid or belong to the other environment.
`403`	The MTO account is not approved and active.
`429`	Too many token requests; reuse a cached token and retry later.