POST/api/v1/moonpay/sign-buy-url

Sign a MoonPay buy link

Countersigns a MoonPay purchase link so the payment widget will accept it, checking the link is tagged with the caller's own identity and delivery address, and recording that address in the audit log.

AccessRequires a permission in the workspaceVIEW_BALANCES

Members can buy Bitcoin with regular money through MoonPay (moonpay.com). The widget will only open a purchase from a link the platform has countersigned, so build the widget URL, send it here with the delivery address, and put the returned signature back on the link. The signing secret stays on the platform: it is never handed to the browser, which is why the countersigning happens through this call rather than in your front end.

The coins are delivered to the member's own profile address, derived from their own registered key, so the platform never takes custody of them. Read that address from GET /api/v1/signing-profile-address and pass it as wallet_address. Where a member has several registered keys, the address is what identifies which key is meant, and if your application and the platform disagree about it the request is rejected rather than guessed.

The link must carry the caller's own identity

widget_url must carry a walletAddress equal to wallet_address and an externalCustomerId equal to the caller's own user id. A purchase therefore cannot be tagged with another member's identity or pointed at an address the platform cannot attribute to the caller. The delivery address is recorded in the audit log.

Body parameters

workspace_idnumberrequired

The workspace the purchase is made in. You must hold VIEW_BALANCES in it.

widget_urlstringrequired

The MoonPay widget URL to countersign. It must carry walletAddress equal to wallet_address and externalCustomerId equal to your own user id.

wallet_addressstringrequired

The address the purchased Bitcoin is delivered to, which is your own profile address on the network.

vault_idstringoptional

The vault the purchase relates to.

bash

curl -X POST "$SQRL_API/api/v1/moonpay/sign-buy-url" \
  -H "authorization: Bearer $SQRL_TOKEN" \
  -H "content-type: application/json" \
  -d '{
        "workspace_id": 342,
        "widget_url": "https://buy.moonpay.com/?apiKey=<moonpay-public-key>&currencyCode=btc&baseCurrencyCode=gbp&baseCurrencyAmount=5000&walletAddress=bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h&externalCustomerId=4021",
        "wallet_address": "bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h",
        "vault_id": "vault_01HZXB2K7P"
      }'

const res = await fetch(`${process.env.SQRL_API}/api/v1/moonpay/sign-buy-url`, {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.SQRL_TOKEN}`,
    "content-type": "application/json",
  },
  body: JSON.stringify({
    workspace_id: 342,
    widget_url:
      "https://buy.moonpay.com/?apiKey=<moonpay-public-key>&currencyCode=btc&baseCurrencyCode=gbp&baseCurrencyAmount=5000&walletAddress=bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h&externalCustomerId=4021",
    wallet_address: "bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h",
    vault_id: "vault_01HZXB2K7P",
  }),
});
const { signature } = await res.json();

rust

let res = client
    .post(format!("{}/api/v1/moonpay/sign-buy-url", api_base))
    .bearer_auth(&token)
    .json(&serde_json::json!({
        "workspace_id": 342,
        "widget_url": "https://buy.moonpay.com/?apiKey=<moonpay-public-key>&currencyCode=btc&baseCurrencyCode=gbp&baseCurrencyAmount=5000&walletAddress=bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h&externalCustomerId=4021",
        "wallet_address": "bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h",
        "vault_id": "vault_01HZXB2K7P",
    }))
    .send()
    .await?;

Response200 OK

{
"signature": "Yb3K1nQ8tU2vXcRf…9dQ="
}

#What happens next

Put the signature back on the link and open the widget, and the member completes the payment with MoonPay. GET /api/v1/moonpay/transactions then reports the purchase's progress and the Bitcoin transaction id once the coins are sent. When the deposit arrives at the profile address, moving it into a vault is a normal transaction proposal, which POST /api/v1/forward-to-vault creates and the member approves alone.

Was this page helpful?