Developer documentation

Build on the modular wallet control plane

Alloy is a provider-neutral, non-custodial infrastructure layer for digital asset operations. WalletKit starts with a normalized operating model for approved custody providers and customer-controlled stacks, then layers policy, risk, compliance, and reconciliation evidence around every transaction intent.

Start quickstart API reference

POST /v1/wallets/:id/transaction-intents

{
  "asset": "USDC",
  "amount": "10000.00",
  "destination": {
    "address": "0x742d...bD18"
  },
  "policy": "standard-transfer"
}

status: "approved"
provider_profile: "approved_provider"
policy_receipt: "pk_eval_2024_a7f3"
risk_score: 0.12

Quickstart

Connect a provider, list wallets, and submit your first transaction intent in 5 minutes.

Mesh contract

Browse current Mesh REST routes, request fields, response fields, headers, and OpenAPI downloads.

Security model

Review VaultCore/Mesh/HSM trust boundaries, transport posture, and fail-closed behavior.

Receipts

See completion, denial, unsupported-contract, missing-authorization, and approval-pause examples.

Modules

Reference for all 8 modules: WalletKit, ShieldOS, RiskGuard, PolicyKit, ReconFlow, VaultCore, TreasuryAI, TokenForge.

API reference

OpenAPI specs, endpoint reference, authentication, error codes, rate limits, and SDK downloads.

Versions

Trace contract, OpenAPI, service, SDK, compatibility, and changelog state.

AI agents

MCP server integration, delegated authority, tool discovery, and agent patterns for autonomous wallet operations.

Three pillars

Non-custodial

Alloy never touches customer funds or keys. Critical for regulatory clarity and trust boundary separation.

AI-native

Every API is designed for autonomous agent consumption: self-discoverable endpoints, structured errors, and scoped authority.

API

API-first

Dual-protocol (gRPC + REST), spec-driven development, auto-generated SDKs. Integrate in hours, not months.

8 composable modules

Each module is an independent API. Start with WalletKit and add modules as your requirements grow.

Module	Role	Status
WalletKit	Provider-neutral wallet operations	DESIGN PARTNER
ShieldOS	Compliance & KYT screening	PREVIEW
RiskGuard	Pre-sign risk review	PREVIEW
PolicyKit	Governance & approval workflows	PREVIEW
ReconFlow	Reconciliation evidence	PREVIEW
VaultCore	Signing authorization controls	ROADMAP
TreasuryAI	Policy-bounded treasury workflows	ROADMAP
TokenForge	RWA & token operations	ROADMAP

View full module reference →

Architecture

┌─────────────────────────────┐

│ Your Application │

└──────────────┬──────────────┘

│ REST / gRPC

┌──────────────▼──────────────┐

│ Alloy Control Plane │

│ WalletKit · ShieldOS · Risk │

│ PolicyKit · ReconFlow · … │

└──────────────┬──────────────┘

│ Provider API

┌──────────────▼──────────────┐

│ Approved providers │

│ Customer-controlled stacks │

└─────────────────────────────┘

Authentication

All API requests require a bearer token in the Authorization header.

curl -X GET https://sandbox.api.alloy.build/v1/wallets \
  -H "Authorization: Bearer $ALLOY_API_KEY" \
  -H "Content-Type: application/json"

API keys

For server-to-server integrations. Generate from the Alloy dashboard with full account scope.

Agent tokens

Scoped, time-bounded tokens for AI agents with explicit permissions and amount limits. Learn more →

SDKs and specs

TypeScript / Node.js

npm install @alloy-build/sdk

Python

pip install alloy-sdk

OpenAPI spec

JSON · YAML

Get started

Request design-partner access to review WalletKit, explore the API reference, or talk to the team about your operating model.

Request sandbox access Contact us