Skip to content

Overview

Programmable crypto custody — vaults, wallets, and policy-gated transactions.

The XKOVA MPC API is a wallet-as-a-service API. You create vaults (keys that no single party can use alone), derive wallets (addresses) on the chains you support, and submit transactions that are checked against your policy and spend limits before any signature is produced.

Authentication

Every request is signed with one of your API keys. You generate an Ed25519 keypair, register the public half with XKOVA MPC, and sign each request with the private half — XKOVA never holds your private key. The signature covers the timestamp, a nonce, the method, the path, and a hash of the body, and travels in the X-Xkova-Stamp header. Our official SDKs produce this header for you; see the Authentication guide to do it by hand.

Asynchronous by design

Anything that moves money returns 202 Accepted with a resource you can poll, and its state also arrives by webhook. A transaction is not “sent” the moment you POST it — it walks through policy checks, MPC signing, and broadcast, and you observe that via its state.

Errors

Failures return { "error": "<message>", "code": "<slug>" }; the HTTP status carries the category, code is a stable machine slug, and the message names the specific reason when a signing request is refused. See the Error schema.

Per-request Ed25519 signature over timestamp ‖ nonce ‖ method ‖ path ‖ sha256(body), produced with your API key’s private half. The official SDKs build this header for you; the Authentication guide shows the exact encoding for other languages.

Security scheme type: apiKey

Header parameter name: X-Xkova-Stamp