> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rhinestone.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List the QR/transfer token shortlist

> Returns the curated per-chain token shortlist the QR / manual-transfer flow offers as "what are you sending?". That flow has no connected wallet to read balances from, so it needs a suggested set rather than a discovered one. Filtered against the authenticated project's `depositWhitelist` when one is configured, so the flow cannot offer a token the client would reject on arrival. This is a suggestion list, not a capability list — `/chains` remains the authority on what the service supports.



## OpenAPI

````yaml https://raw.githubusercontent.com/rhinestonewtf/openapi/refs/heads/main/deposit-service.json get /qr/tokens
openapi: 3.1.0
info:
  title: Deposit Service API
  version: 1.0.0
  description: >-
    Cross-chain deposit processing service with automatic token bridging and gas
    sponsorship
servers:
  - url: https://v1.orchestrator.rhinestone.dev/deposit-processor
security: []
paths:
  /qr/tokens:
    get:
      tags:
        - Utilities
      summary: List the QR/transfer token shortlist
      description: >-
        Returns the curated per-chain token shortlist the QR / manual-transfer
        flow offers as "what are you sending?". That flow has no connected
        wallet to read balances from, so it needs a suggested set rather than a
        discovered one. Filtered against the authenticated project's
        `depositWhitelist` when one is configured, so the flow cannot offer a
        token the client would reject on arrival. This is a suggestion list, not
        a capability list — `/chains` remains the authority on what the service
        supports.
      parameters:
        - schema:
            type: string
            description: API key for authentication (omit when sending Authorization)
            example: your-api-key
          required: false
          description: API key for authentication (omit when sending Authorization)
          name: x-api-key
          in: header
        - schema:
            type: string
            description: >-
              Bearer platform token (e.g. forwarded by user-service). Takes
              precedence over `x-api-key` when both are present.
            example: Bearer eyJhbGciOi...
          required: false
          description: >-
            Bearer platform token (e.g. forwarded by user-service). Takes
            precedence over `x-api-key` when both are present.
          name: authorization
          in: header
      responses:
        '200':
          description: Token shortlist per chain
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QrTokensResponse'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: API key lacks required deposits scope
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    QrTokensResponse:
      type: object
      properties:
        tokens:
          type: object
          additionalProperties:
            type: array
            items:
              type: object
              properties:
                symbol:
                  type: string
                  example: USDC
                address:
                  type: string
                  example: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913'
                decimals:
                  type: integer
                  minimum: 0
                  example: 6
              required:
                - symbol
                - address
                - decimals
          description: >-
            Keyed by EVM chain id as a decimal string, plus "solana" and
            "hypercore". An empty array means the deposit whitelist disallows
            this chain entirely — clients should hide it rather than offer a
            chain with nothing to send, and it is reported even for chains this
            shortlist does not curate. An absent chain carries no opinion (it is
            allowed, but no shortlist is curated for it) and clients should keep
            whatever default they have for it; the two are not interchangeable.
      required:
        - tokens
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
        details:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
              path:
                type: array
                items:
                  anyOf:
                    - type: string
                    - type: number
              code:
                type: string
            required:
              - message
      required:
        - error

````