Skip to main content
POST
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
Sends amount of coin on chain from your merchant balance. No OTP or password is needed; the signed headers authenticate the request. The fee is taken out of amount: your balance is debited amount and the recipient receives amount − fee. Check the fee first with Calculate Payout Fee. The payout is created with status pending and processed asynchronously. There are no payout webhooks: poll Get Payout with the returned _id until status is completed or failed.
All payout endpoints share a bucket of 10 requests per minute per merchant, and each call to this endpoint counts twice, so you can create about 5 crypto payouts per minute. See Rate limits.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access ID provided by TenderExample: "your-access-id-here"
string
required
Must be application/jsonExample: "application/json"
string
required
A unique key you generate for this payout, up to 200 characters (a UUID works well). Retrying with the same key and the same body returns the original response instead of creating a second payout. See Idempotency.Example: "payout-2026-10-15-0001"

Body

string
required
Coin ID to pay outExample: "usdt"
string
required
Chain ID to send onExample: "tron"
string
required
Amount to pay out, in the coin, as a string. Must be worth at least $20 USD.Example: "50"
string
Destination wallet address on chain. Required if payoutAccountId is not sent.Example: "TQn9Y2khDD9JHTfVE5oB2h8BKWWM4LxKLT"
string
ID of one of your saved, active crypto payout accounts. Its chain and coin must match chain and coin. Required if address is not sent. If you send both, the saved account’s address is used and address is ignored.Example: "66aec7de809b7f45c42a49f9"

Idempotency

Send a unique Idempotency-Key header with every payout request. Keys are scoped to your merchant account and to this endpoint, and are kept for 24 hours.
  • Same key, same body: you get the original response again; no new payout is created.
  • Same key, different body: 409 with Idempotency-Key was already used with a different request.
  • Same key while the first request is still running: 409 with A request with this Idempotency-Key is already being processed. Wait and retry.
  • First request failed: the key is released, so you can retry with the same key.
  • Missing key: 400 with Idempotency-Key header is required.
See Idempotency.

Response

string
required
success on successExample: "success"
string
required
Human-readable result messageExample: "success"
object
required
The new payout record
Additional fields may be present; ignore fields you don’t recognise.

Errors

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required
Content-Type
enum<string>
required
Available options:
application/json
Idempotency-Key
string
required

Unique key for this payout, up to 200 characters. Same key and body within 24 hours replays the original response; a different body or a request still in flight returns 409. Scoped to your merchant account and this endpoint.

Maximum string length: 200

Body

application/json

Send address, payoutAccountId, or both (the saved account wins).

coin
string
required
Maximum string length: 500
Example:

"usdt"

chain
string
required
Maximum string length: 500
Example:

"tron"

amount
string
required

Must be worth at least $20 USD

Maximum string length: 500
Example:

"50"

address
string

Required if payoutAccountId is not sent

Maximum string length: 500
Example:

"TQn9Y2khDD9JHTfVE5oB2h8BKWWM4LxKLT"

payoutAccountId
string

Active crypto payout account with the same chain and coin. Required if address is not sent.

Response

Payout created

status
string
required
Example:

"success"

message
string
required
Example:

"success"

data
object
required

Additional fields may be present; ignore fields you don't recognise.