Public API guide
Local endpoints, authentication, requests, and exchange statuses.
Base URL and responses
Use the origin of this installation as the base URL. API responses are JSON. Errors return an error field with a readable message and a non-success HTTP status.
Authentication
Quotes and the currency catalogue are public. Create local API keys in your account and send Authorization: Bearer YOUR_LOCAL_KEY for user-owned exchange creation and tracking. Keep API keys on your server. Browser sessions use HttpOnly cookies.
Exchange requests
Create with POST /api/exchanges and JSON fields from, to, amount, fixed, address, optional extraId, and optional refundAddress. In live mode, also send the quoteToken from GET /api/quote using the same browser session or Bearer key. The server preserves that estimate and rejects expired or modified quotes. It validates asset availability, limits, and address syntax.
Demo and live modes
Demo orders do not contain a deposit address. POST /api/exchanges/{id}/advance simulates one stage. Live order creation requires a separately configured provider key on the server; never send funds to an illustrative quote.
Order lifecycle
The normal stages are waiting, confirming, exchanging, sending, and finished. A waiting demo order can also be cancelled or expire. Live providers can additionally report verifying, failed, or refunded; these states are shown without inventing a deposit deadline or fee breakdown. GET /api/exchanges/{id} returns the current order.
GET /api/quote?from=btc&to=eth&amount=0.1&fixed=false
POST /api/exchanges
Content-Type: application/json
Authorization: Bearer YOUR_LOCAL_API_KEY
{
"from": "btc",
"to": "eth",
"amount": 0.1,
"fixed": false,
"address": "RECIPIENT_ETHEREUM_ADDRESS",
"quoteToken": "RETURNED_LIVE_QUOTE_TOKEN"
}