Acinq Authentication

generated: '2026-08-17'
method: searched
source: https://phoenix.acinq.co/server/api
docs:
- https://phoenix.acinq.co/server/api
- https://acinq.github.io/eclair/
- https://github.com/ACINQ/eclair/blob/master/docs/API.md
notes: >-
  Derived by SEARCH of ACINQ's own published API references, not from an OpenAPI —
  neither eclair nor phoenixd publishes a machine-readable specification, so
  derive-authentication.py has nothing to read. Both APIs use the same model: HTTP
  Basic with an empty username and a locally generated password. Neither API supports
  OAuth 2.0, OpenID Connect, mTLS or scoped tokens, so scopes/ is intentionally absent.
summary:
  types: [http]
  schemes: [basic]
  api_key_in: []
  oauth2_flows: []
  tenancy: self-hosted
  credential_issuance: locally generated by the daemon on first start; there is no vendor-issued key
schemes:
- name: phoenixdBasicAuth
  api: phoenixd HTTP API
  type: http
  scheme: basic
  username: '' # empty by design — the password is the whole credential
  password_source: ~/.phoenix/phoenix.conf
  config_key: http-password
  privilege: full
  transport_note: >-
    curl form is `-u :<phoenixd_api_password>`. ACINQ's own reference carries an
    explicit warning that this API gives access to funds and must not be reachable
    from the outside world.
  source: https://phoenix.acinq.co/server/api
- name: phoenixdBasicAuthLimited
  api: phoenixd HTTP API
  type: http
  scheme: basic
  username: ''
  password_source: ~/.phoenix/phoenix.conf
  config_key: http-password-limited-access
  privilege: limited
  denied_endpoints:
  - /payinvoice
  - /payoffer
  - /paylnaddress
  - /lnurlpay
  - /lnurlauth
  - /sendtoaddress
  - /closechannel
  - /export
  note: >-
    A genuine two-tier credential model: the limited-access password can read state and
    create invoices/offers but cannot move funds, close channels or export history.
    ACINQ still documents it as sensitive (resource exhaustion by mass invoice creation).
  source: https://phoenix.acinq.co/server/api
- name: phoenixdWebsocketAuth
  api: phoenixd HTTP API
  type: http
  scheme: basic
  alternative: Sec-WebSocket-Protocol header
  applies_to: WS /websocket
  note: >-
    The payments websocket accepts either HTTP Basic or the credential carried in the
    `Sec-WebSocket-Protocol` header, for clients that cannot set an Authorization header.
  source: https://phoenix.acinq.co/server/api
- name: phoenixdWebhookSignature
  api: phoenixd HTTP API
  type: hmac
  direction: outbound
  header: X-Phoenix-Signature
  algorithm: HMAC-SHA256
  signed_payload: the full HTTP POST body, UTF-8 encoded
  secret_source: webhook-secret in ~/.phoenix/phoenix.conf
  note: >-
    This authenticates phoenixd TO the integrator's endpoint, so the integrator can
    verify a webhook call is genuine. See asyncapi/acinq-phoenixd-webhooks.yml.
  source: https://phoenix.acinq.co/server/api
- name: eclairBasicAuth
  api: Eclair JSON API
  type: http
  scheme: basic
  username: ''
  password_source: eclair.conf
  config_keys: [eclair.api.enabled, eclair.api.password, eclair.api.port]
  header_form: 'Authorization: Base64Encoded("":<eclair_api_password>)'
  privilege: full
  note: >-
    The API is disabled by default and must be explicitly enabled with
    `eclair.api.enabled=true`. ACINQ documents that it should NOT be accessible from
    the outside world, comparable to the Bitcoin Core RPC.
  source: https://acinq.github.io/eclair/
gaps:
- No OAuth 2.0 / OIDC / token exchange on either API.
- No scoped or per-key permissions beyond the phoenixd two-password split.
- No key rotation, expiry or revocation surface documented.
- No published machine-readable securitySchemes (no OpenAPI on either API).