Introduction

Base URL

https://api.mpcvault.com/v1

For gRPC, connect to api.mpcvault.com:443 with TLS.

<string> marks a value you supply, such as a vault UUID, wallet address, public key or encoded payload. Replace it with your own value in the format described by that field before sending a request. Ordinary numbers, booleans, enum values and generic text use concrete examples.

What You Can Build

Automated Transactions - Create and execute transactions programmatically with API client signing
Deposit Addresses - Generate unique deposit addresses for customer deposits across multiple chains
Batch Payments - Process payroll, airdrops, and bulk transfers efficiently
Message Signing - Sign messages and typed data for DeFi interactions and authentication
Raw Signing - Sign transactions you build yourself or off-chain messages

Signing Flow

For transaction payloads on built-in networks, API client signing follows this flow when broadcastTx is omitted or true:

Quickstart

Use the same request lifecycle across supported networks. The network guides provide transaction and message payloads.

Preparation

An API token with vault access and an allowed caller IP.
The vault UUID.

Signing mode	Setup	Completion
MPCVault App	Use an existing app-managed wallet; omit `callbackClientSignerPublicKey` when creating the request.	Review and sign in the App.
API client signer	Connect a client signer with vault key access; set `callbackClientSignerPublicKey` to its OpenSSH public key.	Call `ExecuteSigningRequests` with the request UUID.

API wallet creation requires a client signer. Values in angle brackets are placeholders. Check the HTTP status and response error field; see API Errors.

Create a wallet

For a new API wallet, call CreateWallet. For App signing, use an existing app-managed wallet and continue to create a signing request.

curl -X POST https://api.mpcvault.com/v1/createWallet \
  -H "Content-Type: application/json" \
  -H "x-mtoken: <API_TOKEN>" \
  -d '{
    "vaultUuid": "<VAULT_UUID>",
    "callbackClientSignerPublicKey": "<CLIENT_SIGNER_OPENSSH_PUBLIC_KEY>",
    "networkType": "NETWORK_TYPE_EVM",
    "name": "API wallet"
  }'

This example creates an EVM wallet. For another network, use its networkType from Supported Networks. Save details.address and fund or activate it as described in the network guide. Wallet creation requires no separate execution call.

Create a signing request

Save the complete request JSON from your network guide as signing-request.json. Each request contains one transaction or message payload. Submit it with CreateSigningRequest:

curl -X POST https://api.mpcvault.com/v1/createSigningRequest \
  -H "Content-Type: application/json" \
  -H "x-mtoken: <API_TOKEN>" \
  --data-binary @signing-request.json

Save the returned signingRequest.uuid as <SIGNING_REQUEST_UUID>.

Review the request

Retrieve the signing request by UUID with GetSigningRequestDetails:

curl -X POST https://api.mpcvault.com/v1/getSigningRequestDetails \
  -H "Content-Type: application/json" \
  -H "x-mtoken: <API_TOKEN>" \
  -d '{"uuid":"<SIGNING_REQUEST_UUID>"}'

Before signing, verify the transaction’s network, sender, recipient, asset, amount and contract call. For messages, verify the signing wallet, content and protocol context.

Find current actions

GetPendingSigningRequests returns every ongoing request needing this API user’s approval or ready for an eligible bound ClientSigner. Select one vault with vaultUuid, or omit it to query all vaults the token can access. This action queue has no pagination and excludes requests without a vault. Each request’s pendingOperation is either approve, sign, or unset. For an approval action, call ApproveSigningRequest with the request UUID. It records the API user’s approval without signing or requiring a ClientSigner. Full-access and read-only API users can approve eligible requests under the current policy. A signing action lists eligible ClientSigner keys as alternative targets. It means prerequisite approvals are satisfied, not that the hint grants execution permission. The modifying call revalidates access and policy. Use GetSigningRequestList for paginated history in one vault. It returns requests in every status, rather than only actionable requests.

Sign the request

ExecuteSigningRequests uses full access to ask the eligible API ClientSigner to sign one supported wallet request. The body contains only uuid. For API-created requests, callbackClientSignerPublicKey selects the callback signer at creation. Existing requests created in the MPCVault app or by dApps can also be queried and executed when their wallet payload and signer binding are eligible. Vault and organization management requests are queryable but cannot be executed with this method. For App signing, sign in the App and track the result. ExecuteSigningRequests

curl -X POST https://api.mpcvault.com/v1/executeSigningRequests \
  -H "Content-Type: application/json" \
  -H "x-mtoken: <API_TOKEN>" \
  -d '{"uuid":"<SIGNING_REQUEST_UUID>"}'

For transaction payloads on built-in networks, MPCVault broadcasts after signing by default. With broadcastTx: false, your application broadcasts the returned signedTransaction. Custom EVM networks always require application broadcast. Signing success does not confirm on-chain execution.

Track the result

Query the same UUID with GetSigningRequestDetails:

`signingRequest.status`	Meaning
`STATUS_PENDING`	Signing is pending.
`STATUS_SUCCEEDED`	Signing completed. This status does not confirm on-chain success.
`STATUS_FAILED`	The request failed; inspect `failedReason`.

Full-access tokens can read available complete signatures and signedTransaction; the latter is available from GetSigningRequestDetails as well as the execution response. Read-only tokens do not receive signature bytes. Field visibility lists the endpoint-specific fields. After broadcast, use txHash with the network guide’s confirmation query. Check both execution and the intended transfer or contract result. After a timeout, check the existing request and on-chain result before creating another request. See Idempotency.

Reject requests

RejectSigningRequest rejects one UUID. RejectSigningRequests applies existing rejection rules to ongoing wallet and vault-management requests in one or all accessible vaults. Batch rejection requires full access, excludes requests without a vault and ClientSigner key grants, and continues after individual failures.

Encode bytes

Data types and encodings defines REST byte encodings and the base64 command for prepared payloads.

Sign a message

Sign off-chain messages for wallet login, proof of address ownership, or signing orders and authorizations. Select your network’s message type below and submit it with CreateSigningRequest, then sign the request. MPCVault applies the chain’s message format.

Network	Message payload
EVM	`evmMessage`
Solana	`solanaMessage`
Sui	`suiMessage`
Aptos	`aptosMessage`
TON	`tonMessage`

Existing dApp Stellar messages, authorization entries and SEP-10 challenges have dedicated query payloads; they cannot be created with CreateSigningRequest. See Stellar existing requests. Omit broadcastTx. Message signing returns signatures, with no transaction to broadcast and an empty txHash. To sign transactions you build yourself or messages you format yourself, use raw signing.

Raw signing

rawMessage lets you use MPCVault to sign transactions you build yourself, including transfers and contract calls. It also supports off-chain message signing.

Key information	Behavior
Input	Protocol-specific signing bytes or digest, encoded as standard base64 in REST JSON.
Output	Signatures only; `txHash` is empty.
Transaction handling	Your application builds the transaction, inserts the signature, broadcasts it and confirms the result.
Off-chain handling	Your application or the receiving protocol uses or verifies the signature.
Signing modes	App signing or API client signing; see Preparation.

MPCVault does not add chain-specific message prefixes or structured-message formats. Select the hash mode expected by the target protocol. For an EVM, Bitcoin or TRON wallet with a 32-byte protocol signing digest prepared by your application:

curl -X POST https://api.mpcvault.com/v1/createSigningRequest \
  -H "Content-Type: application/json" \
  -H "x-mtoken: <API_TOKEN>" \
  -d '{
    "vaultUuid": "<VAULT_UUID>",
    "callbackClientSignerPublicKey": "<CLIENT_SIGNER_OPENSSH_PUBLIC_KEY>",
    "rawMessage": {
      "from": "<WALLET_ADDRESS>",
      "content": "<BASE64_32_BYTE_DIGEST>",
      "ecdsaHashFunction": "ECDSA_HASH_FUNCTION_USE_MESSAGE_DIRECTLY"
    }
  }'

content encodes the binary signing bytes, rather than their hex text representation. Omit broadcastTx for raw signing.

Wallet key	Hash mode	Signed input
EVM, Bitcoin, TRON (secp256k1)	`ECDSA_HASH_FUNCTION_USE_MESSAGE_DIRECTLY`	Exactly 32 decoded bytes, with no additional hashing. Use the protocol’s prepared signing digest.
EVM, Bitcoin, TRON (secp256k1)	`ECDSA_HASH_FUNCTION_SHA256`	SHA-256 of the decoded `content`. Use this when the target protocol expects that hash.
Solana, Sui, Aptos, TON, Stellar (Ed25519)	Omit `ecdsaHashFunction`, or use `ECDSA_HASH_FUNCTION_UNSPECIFIED`.	Decoded `content`.

Save signingRequest.uuid and sign the request.

Signature format

Message and raw signing share these return formats. Read the signed result from:

ExecuteSigningRequests: signatures.signatures[].
GetSigningRequestDetails: signingRequest.signatures.signatures[].

These signing results are available only with full access. Each item contains one signature field:

Wallet key	Signature field	REST encoding
secp256k1 (EVM, Bitcoin, TRON)	`ecdsaSignature`	`R`, `S`, `V` as decimal strings.
Ed25519 (Solana, Sui, Aptos, TON, Stellar)	`eddsaSignature`	Raw 64-byte signature, base64.

See EVM message signing for recovery ID (V) conventions.

Getting Started

Wallets

Signing Requests

Batch Payments

Deposit & Sweep

TRON Watch Address

Base URL

What You Can Build

Signing Flow

Quickstart

Preparation

Create a wallet

Create a signing request

Review the request

Find current actions

Sign the request

Track the result

Reject requests

Encode bytes

Sign a message

Raw signing

Signature format