Authentication & Security
Access ID
A public credential used to identify your account when making API requests. This identifier is passed in thex-access-id header with every request.
Access Secret
A private credential used for signing and verifying API requests. You must use your secret to generate HMAC signatures for authentication. Never share this key or commit it to version control.Signing Requests
Most Tender API endpoints require requests to be signed using HMAC-SHA256 with your Access Secret. The signature covers your access ID, the request ID and the timestamp; it proves the request came from you and limits replay to a 5-minute window. The request body is not signed. Payment and System endpoints use Basic (Access ID) authentication instead and don’t require a signature — see Authentication for which method each endpoint group uses.Environments
We have two environments in Tender:Payments
Agent
A sub-business or merchant account that can receive cryptocurrency payments independently. Agents have their own wallet addresses and can be managed through the Tender API.Payment Initiation
The process of creating a new cryptocurrency payment request. Returns a wallet address where the customer can send funds on their chosen blockchain.Chain
A blockchain network (e.g., Ethereum, Polygon, BSC) where cryptocurrency transactions are processed. Tender supports multiple chains for flexibility.Coin/Currency
The specific cryptocurrency used for payment (e.g., USDT, USDC, ETH). Each chain may support multiple currencies.Fiat Currency
Traditional government-issued currency that is not backed by a physical commodity but by the government that issued it (e.g., USD, EUR, NGN, GBP). In Tender’s context, fiat currencies are used as the base currency for pricing and conversions. When initiating a payment by fiat currency, you specify the amount in fiat (e.g., $100 USD), and Tender calculates the equivalent cryptocurrency amount based on current exchange rates.Transaction Validation
The confirmation of a cryptocurrency payment after it has been broadcast and confirmed on the blockchain. Returns the transaction status and details.Integration Terms
Webhook
A real-time notification sent to your server when certain events occur (for example, a payment is completed or a subwallet deposit is detected). You register one webhook per merchant account withPOST /v1/api/webhook, giving a URL, the events to receive and custom headers that Tender sends with every delivery. See Webhooks.
Webhook URL
The endpoint on your system where Tender sends webhook events. It is theurl you register with POST /v1/api/webhook; API requests such as payment initiation don’t take a callback URL. It must be a public HTTPS URL and respond with a 2xx status code within 15 seconds. Failed deliveries are not retried.
Exchange Rate
The conversion rate between cryptocurrencies and fiat currencies (e.g., USDT to USD). Tender provides real-time exchange rate data through the API.Request ID
A unique identifier (UUID v4) for each signed API request, passed in thex-request-id header and included in the HMAC signature. Generate a new one for every request. It does not make requests idempotent; payouts use a separate Idempotency-Key header.
Timestamp
The time a signed request is made, as an ISO 8601 string (for example2026-10-15T09:45:53.000Z), passed in the x-timestamp header and included in the HMAC signature. It must be within 5 minutes of Tender’s server time.