Getting started

Before you start#

• A verified Myntkaup account, for a person or a company. The API is opening to accounts step by step: when it's available for yours, an API tab appears in Settings in the webapp.
• For the SDKs, Node.js 18 or later, or Python 3.10 or later. For curl, a shell with OpenSSL 3.
• A server or a computer you control. A private key never belongs in a browser or a mobile app.

Create an API key#

1. Open Settings → API

   Sign in to the webapp, open Settings, choose the API tab and select Create key.

2. Choose a name, permissions, addresses and expiry

   • Name: up to 60 characters, so you recognise the key later.
   • Permissions (scopes): Read account and Read transactions are on by default. Trade and Create gift cards are off; turn them on only for a program that needs them. Permissions can't be changed later.
   • Allowed IP addresses: optional, up to 10 public IPv4 or IPv6 addresses or CIDR ranges (at least /16 for IPv4 and /32 for IPv6). Recommended for keys that trade or create gift cards.
   • Valid for: 30 days, 90 days, 1 year, or no expiry. The default is 90 days. A key without expiry works until you revoke it.

3. Confirm with electronic ID

   Confirm with the Auðkenni app or SIM electronic ID. This only checks that it's you; it doesn't sign you in again. For a company, the person creating the key confirms with their own electronic ID, and the key belongs to the company.

4. Store the private key

   The key pair is made in your browser and only the public key is sent to Myntkaup. You see two values, once: the key id (mk_live_…) and the private key (mk_sk_…). Download the .env file, or copy both into a password manager.

The .env file looks like this:

# Myntkaup API key. Keep this file secret and never commit it.
MYNTKAUP_API_KEY_ID=mk_live_4f9c2a7d1e0b8c6a5d3f
MYNTKAUP_API_PRIVATE_KEY=mk_sk_…

An account can have at most 5 active keys. The account owner gets an email whenever a key is created, revoked or suspended, and 7 days before a key with an expiry date expires.

Install an SDK#

The SDKs sign every request, retry safely and turn errors into typed exceptions.

npm install @myntkaup/api

pip install myntkaup

Make your first request#

GET /v1/me works with any valid key. It returns your account and the key's own details, which makes it a good first call and a good health check.

# Signed by sign-headers.sh: see Authentication
curl https://public-api.myntkaup.is/v1/me \
  $(./sign-headers.sh GET /v1/me | sed 's/^/-H /')

import { Myntkaup } from "@myntkaup/api";

const client = new Myntkaup(); // reads the key from the environment
const me = await client.me();
console.log(me.account.name, me.key.scopes);

from myntkaup import Myntkaup

client = Myntkaup()  # reads the key from the environment
me = client.me()
print(me["account"]["name"], me["key"]["scopes"])

{
  "account": {
    "type": "person",
    "name": "Jón Jónsson",
    "tier": "tier-1"
  },
  "key": {
    "id": "mk_live_4f9c2a7d1e0b8c6a5d3f",
    "name": "DCA bot",
    "scopes": [
      "account:read",
      "transactions:read"
    ],
    "ip_allowlist": [
      "203.0.113.10"
    ],
    "created_at": "2026-11-01T09:30:00Z",
    "expires_at": "2027-01-30T09:30:00Z"
  }
}

Without an SDK, sign the request with the signing function and send it with fetch. Node 20.6 or later loads the .env file for you with node --env-file=.env me.mjs:

import { signHeaders } from "./sign-headers.mjs";

const headers = signHeaders({
  keyId: process.env.MYNTKAUP_API_KEY_ID,
  privateKey: process.env.MYNTKAUP_API_PRIVATE_KEY,
  method: "GET",
  pathAndQuery: "/v1/me",
});
const response = await fetch("https://public-api.myntkaup.is/v1/me", { headers });
console.log(response.status, await response.json());

If you get 401 timestamp_out_of_range, your clock is more than 30 seconds off. GET /v1/status needs no signature and returns the server's clock in server_time.

What next#