Skip to main content
The Moca Network REST API enables server-to-server operations that do not require user presence. Use it for backend automation, credential issuance into encrypted DStorage, and programmatic status checks. Issuers sign credentials with their own keys and encrypt them to the holder; AIR stores and routes opaque ciphertext and metadata only.

​
Base URLs

​
Authentication

Authentication depends on the credential surface:
  • Direct AIR endpoints use a Partner JWT: dstorage/vcs takes it in the x-partner-auth header; initialize-user takes it in the request body as partnerJwt, with your Partner ID in the x-partner-id header.
  • Your issuer backend protects available-vc and issue-vc with x-api-key.
  • Public credential-status endpoints do not require authentication.
  • Self-hosted admin endpoints use x-admin-api-key.
For direct AIR endpoints, sign the Partner JWT with your private key (RS256 or ES256) and include: For direct issuance, put the recipient email in the Partner JWT you send to POST /v2/auth/initialize-user. Other operations, such as custom user authentication, have their own claim requirements. The JWT header must include kid (Key ID) matching a key in your JWKS endpoint and typ: "JWT". For full setup instructions, key generation, and code examples see SDK authentication. API Playground: Requests from the Try it out playground are sent directly from your browser to the API. Your API must allow CORS from your docs origin (e.g. your Mintlify subdomain or custom domain) for the playground to work. If you see 403 from the playground, check that the API allows the request origin and that your Partner JWT is valid.

​
Credentials

On-demand credential issuance resolves the recipient and stores an issuer-signed, holder-encrypted credential in DStorage. See the Issuance API Reference for the initialize-user and dstorage/vcs endpoints, request and response details, and code examples.

​
Agent APIs

The Agent APIs use their own hosts and authentication. They let your backend bind an agent to a user’s AIR Account, mint short-lived agent JWTs, list and verify the user’s credentials, and mint merchant checkout tokens.

Agent APIs

Base URLs, authentication, scopes, and endpoints for partner-bound agents.

​
Code examples

For end-to-end integration examples including issue-and-poll flows, webhook-driven issuance, and retry logic, see Issuance API Reference.