​
1. Get sandbox credentials

Create a client API key in the Forja console. You will receive: 
FORJA_API_KEY=ak_sandbox_...
FORJA_API_SECRET=sk_sandbox_...
The secret is shown once.

​
2. Sign requests

Forja HMAC clients send: 
x-api-key: ak_sandbox_...
x-timestamp: <unix seconds>
x-nonce: <uuid>
x-signature: <hex hmac sha256>
The signing string is: 
METHOD
PATH_WITH_QUERY
RAW_JSON_BODY
UNIX_TIMESTAMP
NONCE
Minimal helper: 
import crypto from "crypto";

function signRequest(method, path, body, apiKey, apiSecret) {
  const timestamp = String(Math.floor(Date.now() / 1000));
  const nonce = crypto.randomUUID();
  const signingString = [method.toUpperCase(), path, body, timestamp, nonce].join("\n");
  const signature = crypto.createHmac("sha256", apiSecret).update(signingString).digest("hex");
  return {
    "Content-Type": "application/json",
    "x-api-key": apiKey,
    "x-timestamp": timestamp,
    "x-nonce": nonce,
    "x-signature": signature,
  };
}

​
3. Create an issuance

See Issuance flow for the full lifecycle. Summary: 
POST /v1/tokens/{tokenId}/issuances
Idempotency-Key: <uuid>
Forja returns an unsigned EVM mint transaction. Your backend signs it with the issuer minter key.

​
4. Submit the signed transaction

Send the signed transaction back to Forja: 
POST /v1/issuances/{issuanceId}/signed
Forja broadcasts the transaction and tracks the receipt.

​
5. Redeem tokens

See Redemption flow for the full requested → receipt → burn → confirmed lifecycle.