Crypto exchange API, SDK and swap widget

The six calls

Two more when you want them: /v1/partner/private-quotes and /v1/partner/private-orders route a swap through an intermediate anonymous asset in two chained legs, and /v1/export/rates.xml publishes the best cross-provider rate per direction as a BestChange-style feed.

A client, in about thirty lines

There is no SDK package to install — and the surface does not need one. This is the whole thing:

const BASE = "https://api.swapzilla.io";

export class SwapZilla {
  constructor(private key: string) {}

  private headers() { return { "X-API-Key": this.key, "Content-Type": "application/json" }; }

  assets() {
    return fetch(`${BASE}/v1/assets`).then((r) => r.json());
  }

  quotes(q: Record<string, string>) {
    return fetch(`${BASE}/v1/partner/quotes?${new URLSearchParams(q)}`, {
      headers: this.headers(),
    }).then((r) => r.json());
  }

  createOrder(body: object, idempotencyKey: string) {
    return fetch(`${BASE}/v1/partner/orders`, {
      method: "POST",
      headers: { ...this.headers(), "Idempotency-Key": idempotencyKey },
      body: JSON.stringify(body),
    }).then((r) => r.json());
  }

  order(id: string) {
    return fetch(`${BASE}/v1/partner/orders/${id}`, { headers: this.headers() })
      .then((r) => r.json());
  }
}

The streaming endpoint is the one worth a little more code, because it is what makes the UI feel instant:

const res = await fetch(sseURL, {
  headers: { "X-API-Key": key, Accept: "text/event-stream" },
});
const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();
// split on "\n\n", read the "event:" / "data:" lines, and render each `offer`
// as it lands. `done` ends the stream and carries the final `deviations` map —
// re-rank the offers you already drew instead of waiting to draw them.

Shipping it as a widget

A widget lives in someone else's page, which is exactly where an API key must never be. The layout that works:

• Proxy every keyed call. The API answers with Access-Control-Allow-Origin: *, so a browser can call it — and then the key is one DevTools tab away from anyone.
• Pass the stream through. Your proxy can forward text/event-stream untouched; the widget keeps its live prices without ever seeing the key.
• Cache quotes for 5–10 seconds. There is no rate limit on our side, but providers throttle repeated quoting long before your users notice.
• Show what the user is choosing between. Each offer carries ProviderName, EstimatedMins, KycRating (A to D) and DeviationPercent — the cheapest offer is not always the one they want.
• Validate the destination address with /v1/validate-address before the submit button lights up. It is a keyless call, so the widget can make it directly.

What you build, and what you get

Not on offer, so that nobody plans around it: there is no published SDK package, no hosted widget bundle, no webhooks, and no production sandbox — for deterministic smoke tests we can enable a mock provider on your key instead.

Who integrates it

• Wallets adding swap without adding custody, liquidity or a licence conversation.
• Telegram bots and mini apps, where the whole exchange is four screens and the key sits safely on the bot's server.
• Aggregators and monitors, which can also read /v1/export/rates.xml directly.
• Portfolio trackers and dashboards turning "you are overweight in ETH" into a swap the user can accept in place.

Questions