Get a card
API & Agents

An API that thinks
like a wallet.

REST v1 for humans. Native MCP for Claude, ChatGPT, Cursor and any AI agent. Sign up, top up, issue cards, spend, watch transactions, file disputes — fully autonomous, no human in the loop.

Get an API key Browse endpoints ↓
REST v1 · 50+ endpoints MCP v0.4 · 40+ tools OAuth 2.1 + DCR HMAC webhooks
Two surfaces

One programme. Two ways to integrate.

REST for the integrations you control end-to-end. MCP for the agents that drive the integration on their own.

REST API v1 For your servers, scripts and SDKs
  • 50+ endpoints, every account action covered
  • JSON Schema typed · OpenAPI 3.1 spec
  • Idempotent, paginated, cursor-based
  • Keys generated in the panel → API Settings
  • HMAC-signed webhooks with replay protection
  • Rate-limited per key · 60 req/s burst, 1000 req/min sustained
  • Backwards-compatible, versioned (v1 LTS forever)
Endpoint catalog
MCP Server For Claude, ChatGPT, Cursor, Continue, any agent
  • Native Model Context Protocol server, hosted by us
  • 40+ tools mapped 1:1 from REST endpoints, agent-friendly names
  • Streamable HTTP transport · stateless or session
  • OAuth 2.1 + DCR — agents enrol themselves at runtime
  • Drop-in for Claude Desktop, Cursor, Continue, mcp-cli
  • Per-tool scope grants — restrict an agent to read-only, or to one card
  • Same SLA, same rate limits, same audit log
MCP integration
Quickstart

From zero to live card in three calls.

Sign up, top up, issue a card. The whole flow fits in a single shell session — for both humans and agents.

API keys are generated in the panel at /api-settings. The bearer token below is a short-lived session bearer from the signup response — fine for testing, but for production swap it for a long-lived ccm_live_… key.

1 · sign up & get an API key 
# Create an account — no KYC, no documents
curl https://api.cryptocardium.com/v1/accounts \
  -H "Content-Type: application/json" \
  -d '{
    "email": "agent@example.com",
    "password": "long-random-string"
  }'

# → 201 Created · session bearer in the response
{
  "id": "acc_8f3a91b7c4d2",
  "email": "agent@example.com",
  "bearer": "sess_94d72b6c..."
}
2 · top up your treasury 
# Create a USDT-TRC20 deposit address
curl https://api.cryptocardium.com/v1/topups \
  -H "Authorization: Bearer $CCM_KEY" \
  -H "Idempotency-Key: top_43285e905faf3a51" \
  -d '{
    "amount_usd": 500,
    "asset": "USDT",
    "chain": "tron"
  }'

{
  "id": "top_4e21a99c7b",
  "status": "pending",
  "amount_usd": 500,
  "deposit_address": "T9zFR...kQp",
  "qr_data_uri": "data:image/png;base64,...",
  "expires_at": "2026-05-19T08:00:00Z"
}
3 · issue a card & spend 
# Once your top-up confirms, issue a Visa Platinum
# loaded with $300, Apple/Google Pay-ready.
curl https://api.cryptocardium.com/v1/cards \
  -H "Authorization: Bearer $CCM_KEY" \
  -d '{
    "type": "virtual",
    "bin": "489517",
    "load_usd": 300,
    "wallet_provision": ["apple_pay", "google_pay"]
  }'

{
  "id": "card_8f3a91b7c4d2",
  "bin": "489517",
  "last4": "4218",
  "status": "active",
  "balance_usd": 300,
  "wallet": {"apple_pay": "ready", "google_pay": "ready"}
}
Endpoint catalog

Every action, programmable.

Account, topups, cards, transactions, logs, withdrawals, disputes, webhooks — the full surface of the panel, exposed as REST endpoints and MCP tools.

Account & profile

7 endpoints
  • POST /v1/accounts Create a new account (no KYC, no documents). create_account
  • POST /v1/sessions Sign in with email + password (returns bearer). sign_in
  • DELETE /v1/sessions Sign out the current session. sign_out
  • GET /v1/accounts/me Return the current account, balance, 2FA state. get_account
  • PATCH /v1/accounts/me Update account email, password, notifications. update_account
  • POST /v1/accounts/me/totp Enrol an authenticator (returns secret + URI). enable_2fa
  • DELETE /v1/accounts/me/totp Disable 2FA (requires password + valid code). disable_2fa

API keys

3 endpoints
  • GET /v1/api_keys List your API keys (prefix only, never the secret). list_api_keys
  • POST /v1/api_keys Create a new key. Plaintext returned ONCE. create_api_key
  • DELETE /v1/api_keys/:id Revoke a key immediately. revoke_api_key

Balance & treasury

2 endpoints
  • GET /v1/balance Current USDT balance. get_balance
  • GET /v1/balance/history Time-series of balance changes. get_balance_history

Top-ups

4 endpoints
  • POST /v1/topups Create a top-up: returns deposit address + QR. create_topup
  • GET /v1/topups List your top-ups (filter by status, date). list_topups
  • GET /v1/topups/:id Get a top-up (status, confirmations, txid). get_topup
  • POST /v1/topups/:id/cancel Cancel a pending top-up. cancel_topup

Cards · issuance

5 endpoints
  • GET /v1/cards List your cards (filter by status, type, BIN). list_cards
  • POST /v1/cards Issue a new card (virtual or physical). issue_card
  • GET /v1/cards/:id Card metadata (status, BIN, last4, balance). get_card
  • GET /v1/cards/:id/pan Full PAN + CVV (sensitive, single use, audited). reveal_pan
  • POST /v1/cards/:id/replace Replace a card (new PAN, virtual reissue). replace_card

Cards · operations

8 endpoints
  • POST /v1/cards/:id/load Load USDT from balance onto the card. load_card
  • POST /v1/cards/:id/unload Move unspent balance back to your treasury. unload_card
  • POST /v1/cards/:id/freeze Freeze the card (auths declined). freeze_card
  • POST /v1/cards/:id/unfreeze Re-enable a frozen card. unfreeze_card
  • POST /v1/cards/:id/cancel Permanently cancel the card. cancel_card
  • PATCH /v1/cards/:id/limits Set per-card tx / daily / monthly ceilings. set_card_limits
  • PATCH /v1/cards/:id/mcc Allow or deny MCC categories (lists). set_mcc_rules
  • PATCH /v1/cards/:id/geo Geo-lock the card to specific countries. set_card_geo

Transactions

4 endpoints
  • GET /v1/transactions List all card transactions (paginated). list_transactions
  • GET /v1/transactions/:id Single auth/capture/refund event. get_transaction
  • GET /v1/cards/:id/transactions Per-card transaction history. list_card_transactions
  • GET /v1/transactions/:id/auth Raw auth message (ISO 8583 fields). get_auth_details

Activity & audit logs

3 endpoints
  • GET /v1/activity Unified event stream (top-ups + cards + spends). get_activity
  • GET /v1/activity?type=error Filter by event type (topup/card/spend/error). filter_activity
  • GET /v1/audit_log Account-level audit log (signins, key uses). get_audit_log

Withdrawals

3 endpoints
  • POST /v1/withdrawals Withdraw USDT to an external wallet. withdraw
  • GET /v1/withdrawals List your withdrawal requests. list_withdrawals
  • GET /v1/withdrawals/:id Get a withdrawal (status, on-chain txid). get_withdrawal

Disputes & chargebacks

4 endpoints
  • POST /v1/disputes Open a chargeback on a transaction. file_dispute
  • GET /v1/disputes List your disputes (open / responded / closed). list_disputes
  • GET /v1/disputes/:id Single dispute (status, response, evidence). get_dispute
  • POST /v1/disputes/:id/evidence Attach evidence (receipts, screenshots, notes). add_dispute_evidence

Webhooks

5 endpoints
  • GET /v1/webhooks List your webhook subscriptions. list_webhooks
  • POST /v1/webhooks Subscribe to events (URL + event types). create_webhook
  • PATCH /v1/webhooks/:id Update URL, events, or rotate the signing key. update_webhook
  • DELETE /v1/webhooks/:id Unsubscribe. delete_webhook
  • POST /v1/webhooks/:id/replay/:eid Replay an event to your endpoint. replay_webhook

Support & system

4 endpoints
  • POST /v1/tickets Open a support ticket (requires active card). open_ticket
  • GET /v1/tickets List your tickets. list_tickets
  • GET /v1/system/health Health check (issuer, rails, network status). get_system_health
  • GET /v1/system/limits Your current rate-limit + spend ceilings. get_limits
Agent autonomy

What a Claude or ChatGPT agent does, on its own.

Given a task like "buy 100 cloud credits with crypto," an agent chains the calls below — no human in the loop. Every step is a single tool call.

  1. 01

    POST /v1/accounts · create_account

    Agent generates a fresh email-and-password, posts it. No KYC, no documents. Receives a bearer token in ~200ms.

  2. 02

    POST /v1/topups · create_topup

    Agent requests a top-up in any supported crypto (USDT-TRC20 is cheapest). Receives a deposit address. Sends crypto from its wallet. Webhook fires when funds confirm.

  3. 03

    POST /v1/cards · issue_card

    Agent picks the BIN that matches the merchant (Visa Business for ads, Visa Platinum for mobile wallets, Visa Corporate for SaaS), loads $X, gets a live card.

  4. 04

    GET /v1/cards/:id/pan · reveal_pan

    Agent reveals PAN + CVV + expiry (single-use, audited). Uses them at the merchant checkout. 3-D Secure challenges are approved via webhook callback.

  5. 05

    GET /v1/activity · get_activity

    Agent polls (or subscribes via webhook) for auth events. Confirms the spend went through. Reads the merchant name, MCC, amount, currency.

  6. 06

    POST /v1/cards/:id/freeze · freeze_card

    Job done. Agent freezes (or cancels) the card. Unspent balance can be unloaded back to treasury. The whole flow took under a minute.

MCP integration

Drop-in for Claude, ChatGPT, Cursor.

Add our hosted MCP server to your agent's config. The agent picks up 40+ tools automatically — every REST endpoint, mapped to an agent-friendly tool name.

Claude Desktop / Claude Code Anthropic's reference agent runtime 
~/.config/claude/claude_desktop_config.json
{
  "mcpServers": {
    "cryptocardium": {
      "url": "https://mcp.cryptocardium.com/v1",
      "transport": "http"
    }
  }
}
Cursor / Continue / mcp-cli Any MCP-compatible client 
# Streamable HTTP transport, OAuth 2.1 DCR
mcp-cli add cryptocardium \
  --url https://mcp.cryptocardium.com/v1 \
  --auth oauth

# The agent enrols itself on first connection,
# no API key needs to be pasted.
40+ tools

Every REST endpoint has a matching MCP tool, named for agent comprehension. A small sample:

create_account sign_in create_topup get_topup issue_card load_card reveal_pan freeze_card unfreeze_card set_card_limits set_mcc_rules list_transactions get_activity withdraw file_dispute create_webhook get_audit_log get_balance get_system_health … 21 more
Auth & security

Three ways to authenticate.

Bearer tokens for simple scripts. API keys for production servers. OAuth 2.1 with DCR for agents that enrol themselves.

Bearer session

From POST /v1/sessions. Short-lived (30 days). Good for testing and interactive scripts.

Authorization: Bearer sess_94d72b6c…

API key

From API Settings. Persistent (until revoked). Carry account-level permissions. Best for backend integrations.

Authorization: Bearer ccm_live_a1b2c3d4…

OAuth 2.1 + DCR

Agents register themselves at runtime via Dynamic Client Registration. Per-tool scope grants — restrict an agent to read-only, or to one specific card.

POST /oauth/register
  → client_id, client_secret
POST /oauth/token
  → access_token (scoped)
Webhooks

Subscribe to every event.

HMAC-SHA256-signed payloads. At-least-once delivery with retries. Replay any event from the dashboard or API.

Event types

  • account.created · new sign-up
  • account.signed_in · session start
  • topup.created · deposit address issued
  • topup.confirmed · on-chain finality reached
  • topup.expired · address window closed
  • topup.error · settlement failed (kill-switch, refund)
  • card.issued · new card live
  • card.loaded · funds added to a card
  • card.frozen · agent or admin froze it
  • card.cancelled · permanently retired
  • transaction.authorized · pre-spend
  • transaction.captured · settled by merchant
  • transaction.refunded · refund received
  • transaction.declined · with reason code
  • dispute.opened · chargeback filed
  • dispute.resolved · won / lost
  • withdrawal.broadcasted · on-chain tx sent
  • system.maintenance · scheduled downtime
verify a webhook 
# Headers we set on every webhook
Cryptocardium-Signature: t=1718999999,
  v1=4a8b2f...
Cryptocardium-Event-Id: evt_a1b2c3d4

# Verify (Node example)
const sig = req.headers['cryptocardium-signature'];
const [t, v1] = parseSig(sig);
const expected = hmac(
  'sha256',
  SIGNING_SECRET,
  `${t}.${rawBody}`
);
if (!timingSafeEqual(v1, expected)) reject();
60 req/s Burst

Per API key. Short bursts above the steady rate are tolerated for sub-second windows.

1k req/min Sustained

Per API key. Exceeded requests receive 429 Too Many Requests with a Retry-After header.

25 MB Payload max

Request and response bodies. Dispute evidence supports streaming uploads up to 100 MB.

99.99% Uptime · 90d

Multi-region active-active. Status page at status.cryptocardium.com.

Open the API

Build, automate, agent.
Anything cards can do, your code can.

Sign up, head to the panel, generate a key, plug it into your agent. Sixty seconds from zero to autonomous spending.

Get an API key See the cards
FAQ

API and MCP server, answered.

Everything people actually ask. Last updated .

Where is the OpenAPI specification?

The machine-readable OpenAPI 3.1 spec for the REST v1 surface is published at https://cryptocardium.com/openapi.json (and the YAML stub at /openapi.yaml). Import it into Postman, Insomnia, Stoplight or any AI tooling that consumes OpenAPI.

How does the MCP server discovery work?

The server card is published at https://cryptocardium.com/.well-known/mcp/server-card.json (MCP SEP-1649 format). Authorisation metadata is at /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource (RFC 9728). MCP clients pick up the server end-to-end with no manual config.

Which MCP transports are supported?

Streamable HTTP only (MCP spec 2025-06-18), with optional SSE upgrade for long-running operations. The deprecated HTTP+SSE transport is not supported.

Can an AI agent register itself without manual onboarding?

Yes. Dynamic Client Registration (RFC 7591) is supported on the OAuth 2.1 authorisation server. An agent POSTs its metadata to /oauth/register and receives a client_id and client_secret immediately. Initial scopes are restricted; the agent can request elevated scopes through the standard OAuth consent flow.

Does the API support x402 micropayments?

Yes. Paid endpoints can return HTTP 402 with a structured PAYMENT-REQUIRED header (scheme=exact, network=base, asset=USDC). The agent retries with PAYMENT-SIGNATURE. Native alignment with both Visa TAP and Mastercard Agent Pay.

How are webhooks authenticated?

Every webhook event is signed with HMAC-SHA256. The signing key is generated once on subscription, rotatable on demand. Idempotency keys allow safe replay. Lifecycle events covered: top-up state transitions, card issuance, authorisation, capture, refund, dispute, settlement.

Are scopes per tool or per call?

Scopes are per tool. You can grant an agent read-only on cards (card:read), or issue-only without reveal (card:issue without card:reveal_pan), or scope it down to a single card via fine-grained access policies. Scope grants are revocable at any time.

What is the rate limit?

600 requests per minute per API key, with a 100-request burst. Higher ceilings on request via /contact. Limits are exposed at /v1/system/limits.