API reference

Authentication

Authenticate every request with your app's API key.

Base URL

All endpoints are served from:

https://api.moallet.com

API key header

Combine your client_id and client_secret, separated by a colon, in the Authorization header:

Authorization: ApiKey {client_id}:{client_secret}

Authenticated request

curl "https://api.moallet.com/api/partner/{app_id}/total-balance/" \
  -H "Authorization: ApiKey {client_id}:{client_secret}"

Keep your key safe

Call the API from your server only — never put the client_secret in browser or mobile code.
Store credentials in environment variables or a secrets manager, not in source control.
Use HTTPS for every request.
If a secret leaks, regenerate it on the Developer tab right away.

Read-only keys

For reporting and reconciliation systems, create read-only keys in the console. They use the same header with their key ID — Authorization: ApiKey key_id:secret — and any write returns 403 READ_ONLY_KEY. See Security controls.

Where to find your credentials

Console → Apps → your app → Developer tab.

App IDstring (UUID)
Identifies the app in every path (UUID).
Client IDstring
The public half of your API key.
Client secretstring
The private half of your API key. Shown once when it is created or regenerated.

Response format

Every response uses the same envelope. Check success before you read data.

{
  "success": true,
  "data": {
    "…": "…"
  },
  "error": null
}

Errors

Errors come in two shapes. Authentication failures and unknown resources return a standard 4xx status with a detail field. Business errors — an invalid address, an insufficient pool and so on — return success: false with an error code, sometimes with HTTP 200. Always check success as well as the status code.

401 UnauthorizedAuthentication failed — the API key is missing or invalid.

{
  "detail": "Invalid API key."
}

400 Bad RequestA business error (example).

{
  "success": false,
  "data": null,
  "error": {
    "code": "INSUFFICIENT_POOL",
    "message": "The app pool is below amount + fee."
  }
}

404 Not FoundThe resource doesn't exist.

{
  "detail": "Not found."
}

429 Too Many RequestsToo many requests. Back off and retry.

{
  "detail": "Request was throttled. Expected available in 12 seconds."
}

Supported networks

A public endpoint — no authentication needed. Returns the networks and assets you can use, with their IDs and withdrawal fees.

GET/api/partner/chains/

List supported networks and assets.

Request example

curl "https://api.moallet.com/api/partner/chains/"

200 OK

{
  "success": true,
  "data": [
    {
      "id": 8,
      "name": "Solana Mainnet",
      "symbol": "SOL",
      "protocol": "SOL",
      "is_testnet": false,
      "assets": [
        {
          "id": 1,
          "symbol": "SOL",
          "name": "Solana",
          "type": "NATIVE",
          "decimals": 9,
          "contract_address": null,
          "withdrawal_fee": "0.001"
        },
        {
          "id": 2,
          "symbol": "USDT",
          "name": "USDT (SPL)",
          "type": "SPL",
          "decimals": 6,
          "contract_address": "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB",
          "withdrawal_fee": "1.000000"
        }
      ]
    }
  ],
  "error": null
}

Responses can include extra fields kept for compatibility. Ignore any field that isn't documented here.

Next steps

CustomersCreate customers, look them up and manage their deposit addresses.BalancesRead a customer's spendable balance, adjust it, and check your app pool.