Public integration guide. API base URL: https://api.toknex.space. Confirm network settings and one-time fees in your merchant account.

Security best practices

API keys

Keep keys server-side only: environment variables or your secret manager. Never put them in browser JavaScript, mobile apps, screenshots, tickets or git.
Use one key per environment or server and give each a clear name, so you can revoke one without touching the others.
Rotate by creating a new key, deploying it, checking that requests succeed, then revoking the old key.
Set an IP allow-list (Dashboard → Account) with your servers' outbound IPs. A leaked key is then useless from anywhere else.
If a key may have leaked, revoke it immediately (Dashboard → API keys). Requests using it fail at once.

Always verify the signature and reject timestamps older than 5 minutes.
Verify against the raw body, before parsing it.
De-duplicate on the deposit id and make crediting idempotent (a unique constraint on the gateway deposit id in your database).
Never trust amounts or user ids from anywhere except a verified webhook or our API.
Keep your webhook endpoint on HTTPS and don't log the signing secret.

Credit customers only on deposit.confirmed (or status: CONFIRMED from the API).
Use decimal or string types for money. Floating-point numbers lose precision.
Show the network warning on your payment page: USDT sent on other networks cannot be recovered by us.
Watch out for address poisoning: attackers send tiny transfers from look-alike addresses so the victim later copies the wrong one. Always take the deposit address from our API or the dashboard, never from a wallet's transaction history.

Use a strong, unique password for the dashboard and a work email that you control long-term.
Your payout address is where settlements go: protect the wallet behind it and double-check changes.
Every sensitive action in your account (key creation and revocation, webhook and payout changes, settlements) is recorded in our audit log.

If you find a security issue, contact us privately through support with the details. Please do not disclose it publicly until it is fixed.