> ## Documentation Index
> Fetch the complete documentation index at: https://docs.limitless.exchange/llms.txt
> Use this file to discover all available pages before exploring further.

# Withdraw From Server Wallet

<Info>
  Official SDKs include helper methods for this endpoint.
</Info>

Transfers ERC20 funds from a managed server wallet.

* Route: `POST /portfolio/withdraw`
* Auth: `apiToken`, Privy, or session auth
* Scope: `withdrawal` when using `apiToken`

### Request body

| Field         | Type     | Required | Description                                                                                                                                                            |
| ------------- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `amount`      | `string` | Yes      | Token amount in smallest unit (for USDC: `1000000` = `1` USDC).                                                                                                        |
| `token`       | `string` | No       | ERC20 token address. Defaults to USDC when omitted.                                                                                                                    |
| `onBehalfOf`  | `number` | No       | Managed sub-account profile id. Must be a child of the authenticated partner profile when present.                                                                     |
| `destination` | `string` | No       | Explicit destination address. Must be the authenticated account, authenticated smart wallet, or an active withdrawal address allowlisted on the authenticated profile. |

Use one of these payload shapes:

| Flow                                        | Body                                    | Result                                                                                     |
| ------------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------ |
| Partner sub-account default destination     | `amount` + `onBehalfOf`                 | Withdraws from the child server wallet to the authenticated partner's default destination. |
| Own server wallet to explicit destination   | `amount` + `destination`                | Withdraws from the authenticated caller's own server wallet to an allowed destination.     |
| Partner sub-account to explicit destination | `amount` + `onBehalfOf` + `destination` | Withdraws from the child server wallet to an allowed destination.                          |

### Example: sub-account default destination

```bash theme={null}
curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "onBehalfOf": 12345
  }'
```

### Example: sub-account to allowlisted destination

```bash theme={null}
curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "onBehalfOf": 12345,
    "destination": "0x0F3262730c909408042F9Da345a916dc0e1F9787"
  }'
```

### Example: own server wallet to allowlisted destination

```bash theme={null}
curl -X POST "https://api.limitless.exchange/portfolio/withdraw" \
  -H "content-type: application/json" \
  -H "lmts-api-key: <tokenId>" \
  -H "lmts-signature: <base64_hmac_sha256_signature>" \
  -H "lmts-timestamp: <iso_8601_timestamp>" \
  -d '{
    "amount": "1000000",
    "destination": "0x0F3262730c909408042F9Da345a916dc0e1F9787"
  }'
```

### Destination allowlist

Explicit `destination` values are accepted only when the address is one of:

* the authenticated caller's account address
* the authenticated caller's smart wallet address
* an active withdrawal address allowlisted on the authenticated caller profile

For `onBehalfOf` withdrawals, the allowlist belongs to the authenticated partner profile, not the child `onBehalfOf` profile.

Use [`POST /portfolio/withdrawal-addresses`](/api-reference/portfolio/add-withdrawal-address) and [`DELETE /portfolio/withdrawal-addresses/:address`](/api-reference/portfolio/delete-withdrawal-address) to manage the allowlist.

<Warning>
  Withdrawal-address allowlist management requires a Privy identity token. HMAC/scoped API tokens cannot add or delete withdrawal addresses.
</Warning>

### Notes

* When `destination` is omitted, the API uses the authenticated caller's default destination: smart wallet when present, otherwise account address.
* Destination validation blocks withdrawals to third-party addresses that are not allowlisted.
* Legacy API keys are not supported on server-wallet operations.