Withdraw From Server Wallet

Official SDKs include helper methods for this endpoint.

Transfers ERC20 funds from a managed server wallet.

• Route: POST /portfolio/withdraw
• Auth: apiToken, Privy, or session auth
• Scope: withdrawal when using apiToken

Request body

Field	Type	Required	Description
amount	string	Yes	Token amount in smallest unit (for USDC: 1000000 = 1 USDC).
token	string	No	ERC20 token address. Defaults to USDC when omitted.
onBehalfOf	number	No	Managed sub-account profile id. Must be a child of the authenticated partner profile when present.
destination	string	No	Explicit destination address. Must be the authenticated account, authenticated smart wallet, or an active withdrawal address allowlisted on the authenticated profile.

Use one of these payload shapes:

Flow	Body	Result
Partner sub-account default destination	amount + onBehalfOf	Withdraws from the child server wallet to the authenticated partner’s default destination.
Own server wallet to explicit destination	amount + destination	Withdraws from the authenticated caller’s own server wallet to an allowed destination.
Partner sub-account to explicit destination	amount + onBehalfOf + destination	Withdraws from the child server wallet to an allowed destination.

Example: sub-account default destination

curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "onBehalfOf": 12345
  }'

Example: sub-account to allowlisted destination

curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "onBehalfOf": 12345,
    "destination": "0x0F3262730c909408042F9Da345a916dc0e1F9787"
  }'

Example: own server wallet to allowlisted destination

curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "destination": "0x0F3262730c909408042F9Da345a916dc0e1F9787"
  }'

Destination allowlist

Explicit destination values are accepted only when the address is one of:

• the authenticated caller’s account address
• the authenticated caller’s smart wallet address
• an active withdrawal address allowlisted on the authenticated caller profile

For onBehalfOf withdrawals, the allowlist belongs to the authenticated partner profile, not the child onBehalfOf profile.

Use POST /portfolio/withdrawal-addresses and DELETE /portfolio/withdrawal-addresses/:address to manage the allowlist.

Withdrawal-address allowlist management requires a Privy identity token. HMAC/scoped API tokens cannot add or delete withdrawal addresses.

Notes

• When destination is omitted, the API uses the authenticated caller’s default destination: smart wallet when present, otherwise account address.
• Destination validation blocks withdrawals to third-party addresses that are not allowlisted.
• Legacy API keys are not supported on server-wallet operations.