Version 0.1.3 · Registry installation commands use exact versions.
Protect wallet credentials in API integrations
Use server-side wallet secrets, redacted logging, and understand the API operator trust boundary.
Purchase requests transmit your wallet mnemonic and Fragment session/cookie to the API operator.
A mnemonic controls the wallet. A Fragment cookie controls the supplied session. Never include them in public documentation, CI logs, browser bundles, or localStorage.
Purchase requests transmit these sensitive credentials to the API operator. SDK masking applies to client-side diagnostics only.
All documentation uses environment-variable references or clearly synthetic fixtures. Redirects are disabled in SDK transports; do not enable HTTP debug logging around these calls.
Continue reading
Handle Telegram Stars API 429, Retry-After, and flood wait · Protect wallet credentials in API integrations · Fragment Donor API and SDK FAQ