Build on Tocler
Connect your own systems: deliver from your server, take crypto payments, react to signed events.
Tocler is built to be connected. Everything here is server-to-server over HTTPS, JSON in and out, and every message is signed.
API delivery Your server creates what a buyer gets — codes, accounts, top-ups — signed by Tocler after each payment. Tocler Pay API Take crypto payments straight to wallet addresses, confirmed on the blockchain. Webhooks & signatures Check every message Tocler sends you, the same way everywhere. API reference Every endpoint, field and error.
| Interface | Direction | Who uses it | How it is secured |
|---|---|---|---|
| API delivery | Tocler → your server | Any shop owner, Dashboard → Delivery → API delivery | HMAC-SHA256 signature with your endpoint’s secret |
| Tocler Pay API | Your server → Tocler | Merchants Tocler sets up | A secret API key per server, scopes, limits, allowed IPs |
| Tocler Pay webhooks | Tocler → your server | The same merchants | HMAC-SHA256 signature with the webhook secret |
Ground rules
- Keep keys and secrets on your server only — never in a browser, an app or a public repository.
- Check the signature of every message before you act on it, using the raw body exactly as received.
- Make your handlers safe to run twice for the same message (use its
id). - Use HTTPS with a valid certificate. Tocler never follows redirects and never calls private network addresses.
Was this page helpful?