Authentication - mpcvault

All API requests require the x-mtoken header with your API token.

Getting Your Token

Follow API Setup to create an API user, configure vault access and test the token.

Using Your Token

REST sends the token in the HTTP header; gRPC sends it as request metadata:

x-mtoken: <API_TOKEN>

Access modes

Vault access remains limited to the API user’s configured organization and vault permissions.

Operation	Token access
Query wallets, balances and accessible signing requests	Full access or read-only
Record an eligible API-user approval with ApproveSigningRequest	Full access or read-only, subject to the request’s approval policy
Create requests or wallets, execute wallet signing, reject requests, or update wallets	Full access
Read complete signature bytes or an available signed transaction	Full access; `signedTransaction` on a SigningRequest is available only from GetSigningRequestDetails

Read-only tokens do not receive signatures or signed transaction bytes. The approval method is a policy-controlled exception: it records this API user’s approval without signing or requiring a ClientSigner. A returned pending operation does not grant permission to perform its action.

Security Best Practices

TLS Required - All requests must use TLS 1.2+
IP Allowlist - Restrict API access to specific IPs in the Dashboard
Token Safety - Never expose tokens in client-side code or version control
Rotate Regularly - Generate new tokens periodically and revoke old ones