Signup — API reference

Creating an account without a credential yet: the address challenge, its verification, account creation, and reading the deposit address before the first API key exists.

Generated from openapi.yaml at build time. Base URL https://api.tenergy.me/v1, or https://api-nile.tenergy.me/v1 on Nile (Environments). Every request below is signed as in Authentication unless its Auth line says otherwise.

Issue a signing challenge for a TRON address

POST /v1/accounts/challenge · createAccountChallenge

Auth: Public — no credentials.

Step 1 of the address-challenge signup and recovery model — the platform’s one signup model: ownership of an account is proved by signing a nonce with a TRON address, off our infrastructure. We never see a private key, and there is nothing here to phish — the signature proves control of the address and nothing else.

The returned message is human-readable and domain-bound (brand, purpose, nonce, expiry) so that whoever signs it in a wallet can see what they are agreeing to. Sign it with a TIP-191-style personal-sign; the signature must recover address.

Anonymous, rate-limited per IP and per address. Calling it for an address that already has an account is indistinguishable from calling it for one that does not — this endpoint is deliberately not an account-existence oracle.

Request body

JSON (AccountChallengeRequest), required.

Example request body, from the contract (illustrative values):

{"address":"TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE","purpose":"signup"}

Responses

Response fields (AccountChallenge)

Example 201 response, from the contract (illustrative values — live numbers come from the API):

{
  "nonce": "9f2a7c1e4b6d8a0f3e5c7b9d1f3a5c7e",
  "address": "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",
  "purpose": "signup",
  "message": "tenergy.me wants you to prove control of this address.\nPurpose: signup\nAddress: TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE\nNonce: 9f2a7c1e4b6d8a0f3e5c7b9d1f3a5c7e\nExpires: 2026-09-11T18:14:05.123Z\nSigning this creates no transaction and moves no funds.\n",
  "issued_at": "2026-09-11T18:04:05.123Z",
  "expires_at": "2026-09-11T18:14:05.123Z"
}

Verify a signed challenge and get a bootstrap token

POST /v1/accounts/challenge/verify · verifyAccountChallenge

Auth: Public — no credentials.

Step 2. Checks that signature recovers address over the challenge message and returns a short-lived bootstrap token — the credential that carries the caller from “no account” to “first API key”, and the answer to the contract’s long-standing gap of having no way to authenticate the calls that precede a key.

The bootstrap token is sent as Authorization: Bearer abt_… and opens exactly four operations, nothing else: POST /v1/accounts, GET /v1/accounts/deposit-address, GET /v1/account and POST /v1/api-keys. It expires in 15 minutes, is single-account, and is never a substitute for an API key.

If the address already has an account on this brand, account_id and account_status are returned — to this caller only, because only this caller proved the signature.

A nonce is single-use. A reused, expired or wrongly-signed nonce is one error, 1010 challenge_invalid, whatever went wrong, so that failures reveal nothing about which addresses exist.

Request body

JSON (AccountChallengeVerifyRequest), required.

Example request body, from the contract (illustrative values):

{
  "address": "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",
  "nonce": "9f2a7c1e4b6d8a0f3e5c7b9d1f3a5c7e",
  "signature": "1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b"
}

Responses

Response fields (BootstrapToken)

Example 200 response, from the contract (illustrative values — live numbers come from the API):

{
  "bootstrap_token": "abt_3f8c2d1e9b7a4c6e8f0a2b4d6e8f0a2b",
  "expires_at": "2026-09-11T18:19:05.123Z",
  "account_id": "acc_01J9Z4K2M7Q8",
  "account_status": "active"
}

Create an account

POST /v1/accounts · createAccount

Auth: Bootstrap token or public.

Step 3. Creates the account owned by the signing address and returns it together with its deposit address. The account is created in status: "unfunded": it exists, it can be read, it can receive money and it can issue API keys; it cannot spend until a deposit confirms.

Authenticate either with the bootstrap token from POST /v1/accounts/challenge/verify, or by passing nonce + signature in the body for a one-shot create. Both prove the same thing.

Idempotent by address. If the address already owns an account on this brand, the existing account is returned with HTTP 200 and nothing is created.

email is optional and is not verified here — it is a recovery and invoicing channel, attached later from the dashboard. Email magic-link and Telegram login are additional human logins on the same account object, not a second signup model.

API keys do not wait for a deposit (since 2026-09-26). The balance, not the credential, holds spending back: POST /v1/orders answers 4001 insufficient_funds until the ledger has a confirmed credit.

Request body

JSON (AccountCreateRequest), required.

Example request body, from the contract (illustrative values):

{"address":"TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE"}

Responses

Response fields (AccountCreated)

Deposit address before the first API key exists

GET /v1/accounts/deposit-address · getSignupDepositAddress

Auth: Bootstrap token.

The address to fund so that the account becomes active and can issue a key. Readable with the bootstrap token, so an agent that has just created an account can report the address and the minimum to its user without holding any long-lived credential.

Once a key exists, use GET /v1/deposit-addresses, which returns the same addresses.

Parameters

Responses

Response fields

Example 200 response, from the contract (illustrative values — live numbers come from the API):

{
  "account_id": "acc_01J9Z4K2M7Q8",
  "status": "unfunded",
  "data": [
    {
      "currency": "TRX",
      "address": "TDepositAddressExample1111111111111",
      "memo": null,
      "confirmations_required": 19
    }
  ],
  "min_deposit_sun": 1000000
}