Authentication
API access is authenticated via JWT bearer tokens.
Tokens are obtained from your own participant backend (
POST /auth/token). In production, this will integrate with your organization’s identity provider (Keycloak, Auth0, or equivalent SSO).
Attribution of sender authorization
Your institution holds no on-ledger signing key. Your staff authenticate into the custodian’s console, and the custodian — the regulated entity holding the funds — is the sole sender-side signer. Its co-signature is the controlling authorization for the order. Each sender-side action is written to an append-only audit record, on success and on failure, carrying:- the person who acted (their authenticated identity)
- the institution they acted for
- the custodian that signed
- the action and the order id, which resolves to the terms on the ledger
Data Isolation
Each participant runs their own isolated infrastructure stack: Key properties:- Your backend and database run in your infrastructure, not Musubi’s
- Your database contains only your contracts and transactions — no other participant’s data
- Communication between participants flows through the settlement network protocol, not direct API calls
- No participant can query another participant’s backend or database
Privacy Model
The settlement network enforces privacy at the protocol level — each participant sees only the contracts they are authorized to see.
Key privacy guarantees:
- Market makers never see your identity — RFQs are anonymized (currency pair + amount only)
- Receiver institution sees only the settlement result — not the quoting or rate negotiation process
- No global ledger — unlike public blockchains, there is no shared state that all participants can read