Skip to main content
POST
Create Wallet
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
Creates a wallet and provisions one address on every network that subwallets currently support. Each address gets its own generated address_reference. To add more addresses later, use Create Address.
Wallet references are globally unique across Tender, not only within your merchant account. If the reference is already taken, the request fails with 409. Prefix references with something specific to your platform (for example acme-user-8821).

Example

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access IDExample: "your-access-id-here"
string
required
Example: "application/json"

Body

string
required
A unique identifier for this wallet, such as your own user ID. It must be unique across all Tender wallets. You use it as wallet_reference / merchant_reference in later calls. Maximum 500 characters.Example: "acme-user-8821"

Response

string
required
Example: "success"
string
required
Example: "success"
object
required
Additional fields may be present; ignore fields you don’t recognise.

Error responses

A 503 means the wallet was not created, or its state is unknown. Retry with the same reference; if the wallet was created, the retry returns 409 and you can read it with List Wallets. This endpoint shares the subwallet rate limit of 120 requests per minute. See Rate limits.

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"","requestId":"","accessId":""}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required
Content-Type
string
required

Body

application/json
reference
string
required

Wallet reference. Globally unique across Tender.

Maximum string length: 500
Example:

"acme-user-8821"

Response

Wallet created

status
string
required
Example:

"success"

message
string
required
Example:

"success"

data
object
required