Skip to main content
POST
Transfer Funds
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
One endpoint handles native coin transfers (ETH, TRX, BTC) and token transfers (USDT, USDC). You identify the source address by its wallet reference and address reference; Tender picks the right transfer type from currency. Supported chains: ethereum, tron, bitcoin

Transfer types and responses

A 200 means the transaction was broadcast. Tender sends a sub_user_wallet_transfer_confirmed webhook when it confirms on-chain. A 202 means a gasless operation was accepted but has not settled. Either poll Get Transfer Status with the operation_id, or wait for the sub_user_wallet_transfer_confirmed or sub_user_wallet_transfer_failed webhook. Gasless token transfers spend from the address slot’s gasless_address, so the tokens must be held there.
This endpoint has no idempotency key. payment_reference is stored for reconciliation but does not block duplicates. If a request times out, check List Wallet Transactions for your payment_reference before you retry.

Example

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access IDExample: "your-access-id-here"
string
required
Example: "application/json"

Body

string
required
Chain to transfer on: ethereum, tron or bitcoin.Example: "tron"
string
required
Currency ID to transfer: usdt, usdc, or the native coin ID (ethereum, tron, bitcoin). It must be supported on chain.Example: "usdt"
string
required
Destination address.Example: "TABCef..."
number | string
required
Amount in human-readable units (for example 0.01 ETH or 50 USDT).Example: 50
string
required
The wallet reference of the wallet to send from (the reference you passed to Create Wallet).Example: "acme-user-8821"
string
required
The address_reference of the address slot to send from. Together with merchant_reference and chain, it identifies the source address.Example: "acme-user-8821-slot-2"
string
required
Your own reference for this transfer. It is returned in the transfer webhooks and in List Wallet Transactions.Example: "payout-9922"
string
Optional. The source address, used only as a cross-check. It must match the slot’s address or gasless_address. For a gasless token transfer, omit it or pass the gasless_address; passing the slot’s address is rejected. We recommend omitting sender: the source address is already determined by merchant_reference, address_reference and chain.Example: "TLq9..."

Response

string
required
Example: "success"
string
required
Example: "success"
object
required

Error responses

A 503 doesn’t tell you whether the transfer was broadcast. Check List Wallet Transactions before retrying.

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"","requestId":"","accessId":""}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required
Content-Type
string
required

Body

application/json
chain
enum<string>
required
Available options:
ethereum,
tron,
bitcoin
currency
string
required

Currency ID: usdt, usdc, or the native coin ID (ethereum, tron, bitcoin).

Example:

"usdt"

receiver
string
required
Example:

"TABCef..."

amount
required

Human-readable units.

Example:

50

merchant_reference
string
required

The wallet reference to send from.

Example:

"acme-user-8821"

address_reference
string
required

The address slot to send from.

Example:

"acme-user-8821-slot-2"

payment_reference
string
required

Your reference for this transfer; echoed in webhooks and the transaction list. Not an idempotency key.

Example:

"payout-9922"

sender
string

Optional cross-check; must match the slot's address or gasless_address. Recommended to omit.

Response

Transfer broadcast

status
string
required
Example:

"success"

message
string
required
Example:

"success"

data
object
required