MooChedda API

Generate a new secp256k1 keypair. Returns the wallet address (public key), private key, and a BIP39 12-word mnemonic. Store both the private key and mnemonic securely — neither can be recovered from the server.

// Request
const res = await fetch('https://moochedda.com/wallet/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ label: 'my-wallet' })
});
const { address, privateKey, mnemonic } = await res.json();

// Response
{
  "address":    "04a3f9c2...",  // 130-char uncompressed secp256k1 public key
  "privateKey": "7e2c1b3d...",  // 64-char hex — never transmit this
  "mnemonic":   "word1 word2 ... word12"
}

Restore a wallet from a BIP39 mnemonic phrase. Returns the wallet address so you can verify before proceeding. The server does not store the mnemonic.

const res = await fetch('https://moochedda.com/wallet/recover', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ mnemonic: 'word1 word2 ... word12' })
});
const { address, privateKey } = await res.json();

// Response
{
  "address":    "04a3f9c2...",
  "privateKey": "7e2c1b3d..."
}

Returns all token balances for a wallet address. Redacted by default — an anonymous caller gets shape only (hasBalance, tokenCount), no amounts. To see the real numbers, prove you hold the address's private key and pass the resulting token — see Account Privacy below.

// Anonymous — redacted
const res = await fetch(`https://moochedda.com/balance/${address}`);
const data = await res.json();
// { address, redacted: true, hasBalance: true, tokenCount: 2, transactionCount: 7 }

// Authenticated as the address owner — full detail
const viewToken = await getViewToken(address, privateKeyHex);
const res2 = await fetch(`https://moochedda.com/balance/${address}`, {
  headers: { 'x-view-token': viewToken }
});
const { balances } = await res2.json();
// { "USDC": 500.00, "CHEDDA": 1000 }

Transfer tokens from one wallet to another. Sign the transaction client-side — only the signature travels to the server, never the private key. The server verifies the ECDSA signature against the sender's public address before executing. 0% fee, instant settlement.

// Step 1 — sign locally (private key never leaves the device)
const timestamp = Date.now();
const signature = await signPayload(
  myPrivateKey,
  fromAddress, toAddress, amount, tokenSymbol, timestamp
);

// Step 2 — send only the signed payload
const res = await fetch('https://moochedda.com/token/transfer', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    fromAddress:  '04a3f9...',
    toAddress:    '04b7c2...',
    amount:       100,
    tokenSymbol:  'USDC',
    timestamp,
    signature
  })
});

// Response — 0% fee, instant
{
  "success": true,
  "message": "Token transfer confirmed!",
  "transaction": {
    "from":      "04a3f9...",
    "to":        "04b7c2...",
    "amount":    100,
    "token":     "USDC",
    "timestamp": 1710000000000
  }
}

Confirms that one specific, already-known transfer really settled — built for merchant/relay-style third-party payment verification, where a payer signs and submits a transfer, then discloses the resulting signature to you as proof of payment.

This is deliberately not a general transaction-history lookup. GET /transactions/{address} requires a view token proving you hold that address's private key — a merchant or relay verifying someone else's payment can never legitimately obtain one, and the disclosure/request workflow under /operations/disclosure/* is an operator-only, out-of-band process, not something a payment integration calls automatically. This endpoint needs neither: the signature field is the access key. A real secp256k1 DER signature is ~140 hex characters — computationally infeasible to guess — so the only way you legitimately hold one for a given transfer is that the payer generated it (to submit the transfer in the first place) and then deliberately disclosed it to you. Confirming "yes, a transfer matching what you were told about really settled" doesn't leak anything you weren't already told, and it can never be used to browse or discover a wallet's history.

signature is the only required field. If you also pass any of fromAddress, toAddress, tokenSymbol, amount, or timestamp, every field you pass must match the real settled transfer exactly, or the response is {"exists": false} — this catches a payer who discloses a genuine signature but lies about the amount or parties in the side-channel message (e.g. claiming "I paid you 100 USDC" while pointing at a signature that actually settled for 1 USDC). Passing the full claim, not just the signature, is the safer way to call this for real payment verification.

// Recommended: assert the full claim you were told, not just the signature
const res = await fetch('https://moochedda.com/transactions/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    fromAddress: '04a3f9...',   // what the payer told you — optional, but recommended
    toAddress:   '04b7c2...',
    amount:      100,
    tokenSymbol: 'USDC',
    timestamp:   1710000000000,
    signature:   '3045022100...'  // what the payer disclosed as proof
  })
});
const { exists, settled } = await res.json();
// exists === true, settled === true  ->  the full claim matches a real settled transfer
// exists === false                     ->  no match: wrong amount, wrong parties, unknown
//                                            signature, or the transfer never happened

// Minimal form — signature only, no claim verification
const minimal = await fetch('https://moochedda.com/transactions/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ signature: '3045022100...' })
});
// -> { "exists": true, "settled": true } or { "exists": false }

Generate a payment invoice with line items, optional tax, and accepted tokens. Returns an invoiceId and a hosted payment URL to redirect the customer to. No authentication required — invoices are public payment requests.

const res = await fetch('https://moochedda.com/invoice/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    merchantAddress: '04a3f9...',
    merchantName:    'Acme Store',
    items: [
      { name: 'Widget Pro', price: 49.99, quantity: 2 },
      { name: 'Shipping',   price: 5.00,  quantity: 1 }
    ],
    taxRate:        0.08,
    acceptedTokens: ['USDC', 'CHEDDA'],
    preferredToken: 'USDC',
    expiresIn:      3600
  })
});
const { invoiceId, paymentUrl, total } = await res.json();

// Redirect the customer to pay:
window.location.href = paymentUrl;

// Response
{
  "invoiceId":  "inv_9x2kq...",
  "paymentUrl": "https://moochedda.com/pay/inv_9x2kq...",
  "total":      112.47,
  "status":     "pending",
  "expiresAt":  1710003600000
}

Pay an existing invoice directly via the API. The payer signs the transaction client-side. This is an alternative to redirecting the customer to the hosted payment page.

const invoiceId = 'inv_9x2kq...';

// Fetch invoice to get amount and merchantAddress
const invoice = await (await fetch(`https://moochedda.com/invoice/${invoiceId}`)).json();

const timestamp = Date.now();
const signature = await signPayload(
  myPrivateKey,
  fromAddress, invoice.merchantAddress, invoice.total, tokenSymbol, timestamp
);

const res = await fetch(`https://moochedda.com/invoice/${invoiceId}/pay`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ fromAddress, tokenSymbol: 'USDC', timestamp, signature })
});

// Response
{
  "success": true,
  "invoiceId": "inv_9x2kq...",
  "paidAt":    1710000000000,
  "paidBy":    "04a3f9...",
  "amount":    112.47,
  "token":     "USDC"
}

Poll this endpoint after the customer returns from the hosted payment page to confirm on-chain finality before fulfilling an order. No authentication required.

const res = await fetch(
  `https://moochedda.com/invoice/${invoiceId}/status`
);
const data = await res.json();

// Possible status values:
//  "pending"  — waiting for payment
//  "paid"     — confirmed on-chain
//  "expired"  — invoice timed out

if (data.status === 'paid') {
  fulfillOrder(data.paidBy, data.paidAt);
}

// Response
{
  "invoiceId": "inv_9x2kq...",
  "status":    "paid",
  "paidBy":    "04a3f9...",
  "paidAt":    1710000000000,
  "amount":    112.47,
  "token":     "USDC"
}

Returns ACH and wire bank details to display to users who want to fund their wallet with USDC. Deposits arrive at 0% fee, credited 1:1 USD. The user must include their wallet address as the memo/reference.

const { wire, ach } = await (
  await fetch('https://moochedda.com/usdc/deposit/instructions')
).json();

// Response — same shape for wire and ach
{
  "wire": {
    "bankName":       "Wells Fargo Bank, N.A.",
    "beneficiary":    "MooChedda Inc.",
    "routingABA":     "125009548",
    "accountNumber":  "••••3456",
    "swiftCode":      "WFBIUS6S",
    "processingTime": "Same day or next business day",
    "fee":            "0%",
    "memo":           "Your wallet address (required)"
  },
  "ach": {
    "bankName":       "Wells Fargo Bank, N.A.",
    "routingABA":     "125009548",
    "accountNumber":  "••••3456",
    "processingTime": "1–2 business days",
    "fee":            "0%",
    "memo":           "Your wallet address (required)"
  }
}

Issues a one-time challenge for a wallet address. The returned message is the exact string you must sign — do not hash it first.

const res = await fetch('https://moochedda.com/merchant/auth/challenge', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ address: '04a3f9...' })
});
const { challenge } = await res.json();
// challenge.message  — sign this string
// challenge.nonce    — include in /verify

// Response
{
  "challenge": {
    "address":   "04a3f9...",
    "nonce":     "a1b2c3d4...",
    "message":   "Sign in to MooChedda merchant portal\n...",
    "issuedAt":  "2026-01-01T00:00:00.000Z",
    "expiresAt": "2026-01-01T00:05:00.000Z"
  }
}

Submits the signed challenge. On success the server sets an mc_session cookie that authenticates all subsequent merchant write requests.

elliptic shown below for brevity — see Signing Transactions above for an equivalent @noble/curves version; either works.

// Sign the raw message bytes (not a hash)
const msgBytes = new TextEncoder().encode(challenge.message);
const hashBuf  = await crypto.subtle.digest('SHA-256', msgBytes);
const hashHex  = Array.from(new Uint8Array(hashBuf))
  .map(b => b.toString(16).padStart(2, '0')).join('');

const ec  = new elliptic.ec('secp256k1');
const key = ec.keyFromPrivate(myPrivateKey, 'hex');
const signature = key.sign(hashHex).toDER('hex');

const res = await fetch('https://moochedda.com/merchant/auth/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',  // stores the mc_session cookie
  body: JSON.stringify({
    address:   '04a3f9...',
    nonce:     challenge.nonce,
    signature
  })
});

// Response — mc_session cookie is set automatically
{
  "success":   true,
  "address":   "04a3f9...",
  "expiresAt": "2026-01-01T01:00:00.000Z"
}

Creates a new merchant profile linked to the authenticated wallet address. If a profile already exists for that address this call acts as an update. Requires an active mc_session cookie.

const res = await fetch('https://moochedda.com/merchant/register', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',  // sends mc_session cookie
  body: JSON.stringify({
    address: '04a3f9...',
    name:    'Acme Store'
  })
});
const { merchant } = await res.json();

// Response
{
  "merchant": {
    "address":   "04a3f9...",
    "name":      "Acme Store",
    "logo":      null,
    "createdAt": "2026-01-01T00:00:00.000Z",
    "products":  [],
    "staff":     []
  }
}

Returns a merchant's public profile. No authentication required.

const res = await fetch(
  `https://moochedda.com/merchant/${address}`
);
const { merchant } = await res.json();

// Response
{
  "merchant": {
    "address":   "04a3f9...",
    "name":      "Acme Store",
    "logo":      null,
    "createdAt": "2026-01-01T00:00:00.000Z",
    "products":  [],
    "staff":     []
  }
}

Update a merchant's name and/or logo. The logo field accepts either a URL string or a base64-encoded image (include the data URI prefix, e.g. data:image/png;base64,...). Only the owner's session is accepted. Omit a field to leave it unchanged.

// Convert a File object to base64 (browser)
function toBase64(file) {
  return new Promise((resolve, reject) => {
    const reader = new FileReader();
    reader.onload  = () => resolve(reader.result); // data:image/...;base64,...
    reader.onerror = reject;
    reader.readAsDataURL(file);
  });
}

const logo = await toBase64(fileInputElement.files[0]);

const res = await fetch(`https://moochedda.com/merchant/${address}`, {
  method: 'PUT',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({ name: 'Acme Store', logo })
});
const { merchant } = await res.json();

// Response
{
  "merchant": {
    "address": "04a3f9...",
    "name":    "Acme Store",
    "logo":    "data:image/png;base64,iVBOR..."
  }
}

Add a product to the merchant's catalogue. Accessible by the owner or any staff member. The product is assigned a unique id and immediately available on the merchant's store page.

const res = await fetch(`https://moochedda.com/merchant/${address}/product`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({
    name:  'Widget Pro',
    price: 49.99,
    token: 'USDC',
    desc:  'The best widget on the market.',
    emoji: '🔧'
  })
});
const { product } = await res.json();

// Response
{
  "product": {
    "id":        "p_m3k9x2",
    "name":      "Widget Pro",
    "price":     49.99,
    "token":     "USDC",
    "desc":      "The best widget on the market.",
    "emoji":     "🔧",
    "photo":     null,
    "createdAt": "2026-01-01T00:00:00.000Z"
  }
}

Creates a new token and mints the entire totalSupply to the creator wallet in one atomic operation. The private key is verified to match the creator address before the mint is committed — supply cannot be created by anyone else.

// Mint a new token
const res = await fetch('https://moochedda.com/token/create', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    symbol:      'MYTOKEN',
    name:        'My Token',
    totalSupply: 1000000,
    creator:     '04a3f9c2...',   // your wallet address
    privateKey:  '7e2c1b3d...',   // 64-char hex — use over TLS only
    decimals:    18,
    metadata:    { description: 'My custom token' }
  })
});
const data = await res.json();

// Response
{
  "success": true,
  "message": "Token MYTOKEN created successfully!",
  "token": {
    "tokenId":     "a3b9f1...",
    "symbol":      "MYTOKEN",
    "name":        "My Token",
    "totalSupply": 1000000,
    "decimals":    18,
    "creator":     "04a3f9c2...",
    "createdAt":   1710000000000
  },
  "asset": null
}

Returns paginated transactions involving :address as sender, recipient, or creator. Optionally narrow results to a single token by appending /:tokenSymbol. Results are sorted newest-first. Without a valid x-view-token for this address, the response has redacted: true and an empty transactions array — pagination.total still reflects the real count.

// All transactions for an address — first page
const res = await fetch(
  `https://moochedda.com/transactions/${address}?page=1&limit=50`
);
const data = await res.json();

// Filter by token
const res2 = await fetch(
  `https://moochedda.com/transactions/${address}/USDC?page=1&limit=50`
);

// Response
{
  "success": true,
  "transactions": [
    {
      "type":        "TOKEN_TRANSFER",
      "fromAddress": "04a3f9...",
      "toAddress":   "04b7c2...",
      "amount":      100,
      "tokenSymbol": "USDC",
      "timestamp":   1710000000000,
      "signature":   "3045..."
    }
  ],
  "pagination": {
    "total":      243,
    "totalPages": 5,
    "page":       1,
    "limit":      50,
    "hasNext":    true,
    "hasPrev":    false
  }
}

// Iterate all pages
async function fetchAllTransactions(address, token = '') {
  const path = token ? `/transactions/${address}/${token}` : `/transactions/${address}`;
  let page = 1, all = [];
  do {
    const { transactions, pagination } = await (
      await fetch(`https://moochedda.com${path}?page=${page}&limit=100`)
    ).json();
    all.push(...transactions);
    if (!pagination.hasNext) break;
    page++;
  } while (true);
  return all;
}

Returns all tokens registered on the platform, including symbol, name, total supply, creator address, and decimals.

const { tokens } = await (
  await fetch('https://moochedda.com/tokens')
).json();

// Each token object:
{
  "tokenId":     "a3b9f1...",
  "symbol":      "USDC",
  "name":        "USD Coin",
  "totalSupply": 1000000,
  "decimals":    6,
  "creator":     "04a3f9...",
  "type":        "CURRENCY",
  "createdAt":   1710000000000
}

Returns current prices for all tokens denominated in USDT. Prices update in real time based on on-chain swap activity via the built-in price oracle.

const { prices } = await (
  await fetch('https://moochedda.com/prices')
).json();

// Response
{
  "prices": {
    "USDC":   1.00,
    "CHEDDA": 0.042
  },
  "updatedAt": 1710000000000
}