Payment

API Documentation

mTLS Client Certificate

Your API key works only together with a certificate that stays on your server. A leaked key is useless anywhere else.

  • Attach the certificate in your HTTP client and change the base URL to https://api-mtls.trustsig.xyz.
  • Your API key, secret, headers and request formats stay the same.
  • It is for Production calls made from your own server. Browsers and mobile apps cannot use it.

Set up in four steps

1

Create a key and a certificate request

Run this on your server, then send only trustsig-client.csr to our team. The .key file stays with you. Never send it to anyone.

openssl req -new -newkey rsa:2048 -nodes \
  -keyout trustsig-client.key -out trustsig-client.csr \
  -subj "/CN=<your company name>"
chmod 600 trustsig-client.key
2

Receive the certificate

We send back trustsig-client.pem. Put it next to the .key on every server that calls the API.

3

Attach it and change the base URL

Everything else in your code stays as it is.

import https from 'node:https'
import fs from 'node:fs'
import axios from 'axios'

const httpsAgent = new https.Agent({
  cert: fs.readFileSync('/etc/trustsig/trustsig-client.pem'),
  key: fs.readFileSync('/etc/trustsig/trustsig-client.key'),
})

export const api = axios.create({ baseURL: 'https://api-mtls.trustsig.xyz', httpsAgent })

unconfirmedWhich host goes into the URL you sign is still being confirmed. Make sure step 4 passes before you move real traffic.

4

Test, then tell us

You should see "verified": true. Then call GET /v1/balance/query through the new host. When it returns 200, tell our team.

curl --cert trustsig-client.pem --key trustsig-client.key https://api-mtls.trustsig.xyz/__mtls
# {"presented":true,"verified":true,"status":"SUCCESS", ...}

What happens next

  • We watch your traffic for 3 to 7 days without refusing anything, then tell you the enforcement date in advance.
  • Once enforced, the key works only with the certificate. Calls to the original host are refused with code 2044.
  • The certificate lasts one year. Renew it by sending a new CSR. If a server is lost, tell us to revoke it; the API key does not need to change.