OAuth2 client-credentials on a dedicated auth server, so your client secret never touches the API that serves your data. Every client can be locked to an IP allow-list, every webhook is signed with its own Ed25519 key and delivered from a fixed, published set of IPs, and KYC is built in for every beneficiary before funds move. Security is how the platform works, not a feature you switch on.

Lightning, on-chain Bitcoin, stablecoins, and fiat on/off-ramps behind a single REST API, one token, and one transaction object with the same status lifecycle everywhere. Create an account, issue an invoice, off-ramp to a bank — same client, same auth, same response shapes. No nodes to run, no channels to open, no liquidity to pre-fund. The docs are AI-ready too: a Postman collection for humans and a single llms-full.txt for your coding assistant, so Copilot, Cursor or Claude integrate against the real API instead of guessing. Most teams are making sandbox calls within a day of requesting access.

Sandbox is a full replica of production with its own credentials, console, and base URL. Accounts are unlimited per organization, and production is a fully separate environment backed by a 99% uptime SLA with 24/7 coverage for critical incidents.