Getting Started

MYRT is a Malaysian Ringgit stablecoin. 1 MYRT is redeemable 1:1 for 1 MYR. The partner API is a plain HTTPS JSON interface for issuing, redeeming and moving MYRT from your own platform, and for reading back the state of everything you have done. There is no SDK; you call it with any HTTP client.

With the API your integration can:

• Mint: issue MYRT to a wallet once MYR settlement is confirmed.
• Redeem: burn MYRT from a customer's wallet and pay MYR to their registered bank account.
• Transfer: move MYRT on-chain to a recipient address.
• Look up verification status for the customers and corporates you onboarded.
• Read balances and order status: the on-chain MYRT balance of a wallet address, and the current state of every order you created, by referenceId.

Base URLs

Environment	Base URL	Key prefix
Sandbox	https://sandbox-api.myrt.money/v1	myrt_sandbox_
Live	https://api.myrt.money/v1	myrt_live_

Every response carries X-MYRT-API-Version: v1. The version is in the path and /v1 is stable; see versioning.

A key works only in the environment it was issued for. A sandbox key on the live host, or a live key on the sandbox host, returns 401 UNAUTHORIZED.

Sandbox is a testnet deployment (Sepolia, chain id 11155111, 3 confirmations) with test fiat rails. No real money moves. Live issues on Ethereum mainnet (chain id 1, 15 confirmations). Read the exact chain and token address from /v1/config and /v1/tokens on the host you are talking to; the two environments differ. See network configuration.

The API is server-to-server. No CORS headers are sent, so browser calls are not supported.

DANGER

Never put a key in browser code, a mobile binary, or a public repository.

Every sample on this site uses the sandbox host.

Your first call

GET /v1/health takes no key and confirms you can reach the service.

GET/v1/healthno key required

curl https://sandbox-api.myrt.money/v1/health

200 OK

{
  "ok": true,
  "service": "myrt-api",
  "apiVersion": "v1",
  "status": "healthy",
  "timestamp": "2026-09-10T04:12:33.918Z"
}

Now make an authenticated call. GET /v1/tokens needs a key holding config:read and returns the MYRT contract address for each chain the host serves.

GET/v1/tokensconfig:read

cURL

curl https://sandbox-api.myrt.money/v1/tokens \
  -H "Authorization: Bearer $MYRT_API_KEY"

Node.js

const res = await fetch("https://sandbox-api.myrt.money/v1/tokens", {
  headers: { Authorization: `Bearer ${process.env.MYRT_API_KEY}` },
});
const tokens = await res.json();
if (!tokens.ok) throw new Error(`${tokens.error.code}: ${tokens.error.message}`);

Python

import os, requests

res = requests.get(
    "https://sandbox-api.myrt.money/v1/tokens",
    headers={"Authorization": f"Bearer {os.environ['MYRT_API_KEY']}"},
    timeout=30,
)
tokens = res.json()
if not tokens["ok"]:
    raise RuntimeError(f"{tokens['error']['code']}: {tokens['error']['message']}")

200 OK

{
  "ok": true,
  "tokens": [
    {
      "symbol": "MYRT",
      "name": "MYR Stablecoin",
      "chainId": 1,
      "network": "Ethereum",
      "tokenAddress": "0x...",
      "decimals": 6,
      "explorerUrl": "https://etherscan.io/address/0x..."
    }
  ]
}

The entry describes the chain of the host you called, so sandbox and live return different values.

TIP

Token addresses must be read from /v1/tokens and never hardcoded.

Every response body is JSON with ok: true or ok: false. On failure the body carries error.code, which is stable and is what your integration branches on, and error.message, which is for humans and may be reworded at any time. If this call returns 401 UNAUTHORIZED, check that the key was issued for sandbox. If it returns 403 SCOPE_DENIED, the key lacks config:read. The full catalogue is on the errors page.

What you need from your account manager

Onboarding is done with your MYRT account manager. Before you write code, ask for:

• A sandbox API key with the scopes you need. Keys carry explicit scopes. A request outside the key's scopes returns 403 SCOPE_DENIED. The full key is shown once at creation, so store it as soon as you receive it; a lost key is rotated, not recovered. If you need account:read, a data processing agreement must be on file first, or the scope returns 403 SCOPE_DENIED even though the key was issued with it.
• Customer linking. Every value-moving call carries a customerId (for example cus_9f2a3b4c) that MYRT assigns when a customer is linked to your integration. It is opaque: not a MYRT account id, an email, or anything a customer could be recognised by. A customerId that is not linked to your integration returns 404 NOT_FOUND, so you need linked customers in sandbox before you can mint, redeem or transfer there.
• Webhook endpoint registration. Register an HTTPS endpoint and you receive a webhook secret, shown once. MYRT then POSTs signed settlement events to it. Webhooks are part of the v1 contract and are documented ahead of release; see the webhook guide.
• IP allowlist entries. A key can be restricted to a list of source IP addresses or CIDR ranges. A request from outside the list returns 403 IP_NOT_ALLOWED. Give your account manager the addresses your servers call out from. Restricting every live key by IP is recommended.

Integration checklist

Work through these in order, in sandbox. Live credentials are issued once step 6 reconciles.

1. Get sandbox credentials. A myrt_sandbox_ key with the scopes you need, at least one linked customerId, and your IP allowlist entries if you use one. Store the key where your server can read it; the samples on this site read it from $MYRT_API_KEY.
2. Health and tokens. Call GET /v1/health without a key, then GET /v1/tokens with it. Keep the chainId and tokenAddress you get back, and confirm every response carries X-MYRT-API-Version: v1.
3. Mint to completed and verify the transaction. Create a mint order with fiatConfirmed: false, confirm it with fiatConfirmed: true on a key holding mint:execute, then read GET /v1/mints/{referenceId} until status is completed. Look up blockchain.txHash on the chain and match the Transfer event to amounts.amountRaw. A txHash alone is not final; only completed is. See the mint guide and the order lifecycle.
4. Redeem, including the failure paths. Run a redeem to completed. Then trigger 400 INSUFFICIENT_BALANCE with a wallet that holds less MYRT than requested, and 400 MONTHLY_WITHDRAWAL_LIMIT_EXCEEDED with an amount above the customer's monthly withdrawal limit. Confirm your code branches on error.code and surfaces error.meta. See the redeem guide.
5. Webhook endpoint with signature verification. Serve an HTTPS endpoint that verifies X-MYRT-Signature against the raw request body using the test vector in the webhook guide, responds 2xx within 5 seconds, deduplicates on event id, and reads the order back with the API before crediting anyone.
6. A full day of sandbox orders, reconciled. Run a full day of orders and reconcile every one against your own referenceId list, so that each order is accounted for with its current status. See best practices.
7. Request live credentials. Ask your account manager for a myrt_live_ key restricted to your IP allowlist. If you transfer, hold transfer:execute on a dedicated key and alert on every use. A live key works only on https://api.myrt.money/v1.

Next steps

• Authentication: key format, scopes, idempotency and reference IDs.
• Core concepts: the order lifecycle and how amounts are represented.
• Mint: your first value-moving flow.
• API reference: every endpoint, its request and response shapes, and the OpenAPI document.