Starter kit

Copy-paste building blocks, tested against the API's own signature checks on every release.

Download the kit (.tar.gz)

File	What it is
typescript/neo-wallet-signing.ts	Signing, write headers, transaction binding, webhook verification. node:crypto only.
python/neo_wallet_signing.py	The same for Python ≥ 3.9 (pip install cryptography). Run it to self-test.
bruno/	A Bruno collection that signs every request.
webhook-receiver/receiver.ts	Minimal webhook endpoint: raw body, signature, dedup, fast 2xx.
test-vectors.json	Fixed inputs and outputs for signing, binding and webhooks.
openapi.json	The OpenAPI 3.1 document, for codegen and API clients.

Helpers

import {
  buildRequest,
  loadSigningKey,
  transactionBinding,
  ulid,
  verifyWebhook,
} from "./neo-wallet-signing.ts";

Function	Use
loadSigningKey	PKCS#8 PEM (or base64 32-byte seed) → key object
buildRequest	{ method, headers, body } for one attempt — call again for each retry
ulid	For Idempotency-Key and X-Request-Id
transactionBinding	The assertion.transactionBinding object
verifyWebhook	Webhook signature + timestamp check

Bruno collection

1. Open bruno/ as a collection and switch to Developer Mode (Safe Mode has no Ed25519).
2. Pick the test environment; set baseUrl and keyId, and put apiKey and signingKey in the secret fields. A PEM can be pasted with newlines written as \n.
3. Set customerUid / walletUid, then run Health → Wallet balance.

The collection script adds all auth headers, X-Request-Id, and a fresh Idempotency-Key on writes. To retry under the same key, set that header on the request yourself.

bru run --env test --sandbox developer \
  --env-var apiKey="$NEO_API_KEY" --env-var signingKey="$NEO_SIGNING_KEY"

Webhook receiver

NEO_WEBHOOK_SECRETS='{"whk_2026_09":"nwhs_…"}' PORT=8080 \
  node --experimental-strip-types webhook-receiver/receiver.ts

It verifies against the raw body, answers 204 before doing work, and drops repeated dedupKeys. Keep those three properties when you port it to your framework.

Test vectors

Ed25519 is deterministic: a correct implementation in any language reproduces every signature in test-vectors.json exactly. Wire it into your unit tests before you call the API.