Turnkey crypto brokerage via Bakkt — account opening and KYC, custody, order management, coin transfers, and ACH/wire fiat funding. Served by the pointskash-api-facade, not by this service.
Bakkt is two APIs behind one vendor, and every operation below says which it
belongs to. The crypto gateway (/apex-crypto/api/v2) authenticates with a
logon ID and password, exchanged for a token sent bare in the Authorization header
with no Bearer prefix. The fiat partner API (/partner/v1)
lives on a different host and uses OAuth2 client_credentials, sent as a Bearer
JWT. They share no host, no credential and no auth scheme; the facade holds both and routes
on the tag, so from here it is one API.
Testing: the facade defaults to a deterministic stub, so one journey runs
end to end with no credentials — open an account, fund it over ACH, read a price, buy, hold a
position, withdraw. Everything else returns 501 NOT_IMPLEMENTED_IN_STUB until
the facade is given Bakkt credentials (BAKKT_MODE=live plus
BAKKT_LOGON_ID/BAKKT_PASSWORD and
BAKKT_CLIENT_ID/BAKKT_CLIENT_SECRET).
/api/bakkt/operations
lists exactly which operations the stub simulates, and
/health
shows which provider is actually wired.
Worth knowing before you integrate: account opening is asynchronous (poll
cipClearanceState, do not assume); withdrawals are two calls (fee estimate, then
withdraw quoting the estimate id, with the quantity matching exactly); orders take
notional or quantity but never both, and clientOrderId
is the idempotency key; and a 200 on a fiat transfer means accepted, not
settled — ACH lands T+n and is confirmed by webhook. Bakkt also allowlists the caller's IP per
environment, so live mode only works from a registered egress address.