Developer documentation

MultiNFT tokens are standard ERC-721 tokens. Everything here is public and checkable without asking us for anything.

The mint takes the recipient as a parameter, so the token is delivered to the buyer's wallet rather than to the caller. Settlement is in an ERC-20 — USDC on Base — and the collection accepts that token alone: its receive() reverts NativeValueNotAccepted, so ether stays with its sender instead of resting in a contract that has no way to pay it out. A single transaction takes the settlement, splits it and mints the token, and it reverts as one, so a partial success cannot leave a buyer charged while the token is still unminted.

Token metadata follows the ERC-721 metadata standard and resolves per item, not per token:

Document	https://multinft.app/meta/{sku}.json — and by record number, which is the form tokenURI emits: https://multinft.app/meta/{recordId}.json
Artwork	https://multinft.app/meta/{sku}.svg
Catalogue	https://multinft.app/api/catalog

The document carries the item's name, what it grants and a link to its record. A record also lists its artist, its collection and its edition as on-chain traits, so a wallet shows it as the artist's own work. It carries no price and no scarcity language: token metadata is permanent public copy, read by wallets years from now, and the item's own page is where a figure belongs. It carries no buyer address, no order reference and no personal data of any kind — and because it resolves per item, there is no per-token document in which such a value could sit. The published response is scanned before it is served, and any document containing something address-shaped or order-shaped is blocked rather than returned.

Each piece's engraving is generated deterministically from its SKU: the SKU seeds the line generator, so the same SKU always draws the same piece, and every SKU draws a different one. Because there is no shared static image across tokens, tokens are distinguishable on-chain and nothing about the wider catalogue is inferable from a single token's artwork.

Card payments are processed by a regulated payment partner acting as merchant of record. It performs the identity checks its thresholds require and settles on-chain to the minting contract. MultiNFT never handles card data.

Payment notifications are verified by HMAC-SHA256 over the raw body with a constant-time comparison, and the endpoint refuses to operate when no secret is configured rather than accepting an unsigned request. Order state is idempotent: a replayed notification creates no second obligation, and a late success still lands.

https://multinft.app/healthz reports liveness and the build identifier. The build id is included deliberately, so the code that is running is the code that was committed — a version string alone can be reshipped with different code and tell you nothing.