Lock a signed quote

0Gate is the primary public integration path for hosted payment, ramp, and swap experiences. Keep secret-key operations on your server and hand only browser-safe values to the widget.

Endpoint

Use it for

Lock a rate for a single, server-side rail flow. The call returns an HMAC-signed, one-time-redeemable LockedQuote: its id is the quote_id you pass to POST /rails/pay_ins or POST /rails/pay_outs, and it can also be passed as quote_preview_id when creating a hosted session. The rate holds for a short configured TTL. This route requires account-gated rail access.

Use this endpoint only for the partner-scoped resource it describes. Store your own reference id, the returned quote id, the request id, timestamps, and the current status so support and reconciliation do not depend on browser callbacks alone.

Production rules

• Keep secret keys on your server. This endpoint requires a sk_* key. Publishable pk_* keys are browser-only and cannot lock quotes.
• Validate environment, mode, entitlement, asset, network, and amount before the call.
• Treat the lock as single-use. Each LockedQuote redeems exactly once; a second redemption is a conflict.
• Branch on machine-readable status, error code, object id, and request id.
• Treat examples and placeholder ids as fake data only.

Request body

Response

201 returns a signed LockedQuote (object: signed_quote). It captures the locked economics, the redemption status, and the signature you can verify out-of-band.

Examples

curl -X POST https://gate-api.0bit.app/v1/quotes \
  -H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "currency": "EUR",
    "asset": "USDC",
    "amount": "1000.00",
    "side": "on_ramp",
    "payment_method": "sepa_credit_transfer",
    "country_code": "DE"
  }'

{
  "object": "signed_quote",
  "id": "qt_test_9f8e7d6c5b4a",
  "status": "active",
  "side": "on_ramp",
  "currency": "EUR",
  "asset": "USDC",
  "payment_method": "sepa_credit_transfer",
  "fiat_amount": "1000.00",
  "crypto_amount": "1067.40",
  "exchange_rate": "1.0674",
  "fees": {
    "spread": "5.30",
    "fixed": "0.50",
    "total": "5.80"
  },
  "fiat_pay_or_receive": "1000.00",
  "usd_amount": "1073.10",
  "signature": "t=1767225600,v1=4a7f...e9b2",
  "expires_at": "2026-01-01T00:00:30Z",
  "created_at": "2026-01-01T00:00:00Z"
}

Errors

All errors use the unified envelope and carry an X-Request-Id response header. Branch on code/type/statusCode, not on the free-form message.

{
  "type": "forbidden",
  "code": "forbidden",
  "message": "Example authorization error using fake data.",
  "request_id": "req_test_000000000123",
  "doc_url": null,
  "statusCode": 403
}

Public boundary

This reference covers partner-scoped endpoint behavior, authentication, idempotency, webhook verification, and support-safe records. Internal operations, settlement venues, provider details, administrative routes, and unsupported availability claims are outside the public API contract.

Related pages