How can a reciever verify that transaction data was not altered by 3rd party?
All sensitive operations must be performed on your side. You cannot perform them on the client side and trust the client to pass you the correct information. If you need to call some API to get wallet information, your server needs to make that call.