Capitalist Authentication

generated: '2026-09-05'
method: searched
source: >-
  https://docs.capitalist.net/api/integration-api.html sections 2 (Authentication),
  2.2 (Signature Calculation Example) and 3 (Security: IP Whitelist), cross-checked
  against the first-party OpenAPI at
  https://github.com/capitalist-net/API-V2/blob/main/java-client/api-definition/Integration+API.json
  and a live anonymous probe of https://api2.capitalist.net/v1/rate (HTTP 401,
  body "Missing `API-Key`", observed 2026-09-05).
provider: Capitalist
providerId: capitalist
description: >-
  Capitalist runs two authentication models side by side. The current
  Integration API (v2, https://api2.capitalist.net) uses a three-header
  signed-request scheme: an API key, a millisecond epoch timestamp, and a
  SHA-256 hex signature over the timestamp, the raw request body and the API
  secret. The deprecated v1 API (https://api.capitalist.net) authenticates with
  the account login plus either a plain password, an encrypted password or a
  certificate signature carried as form fields. Neither surface uses OAuth, and
  no /.well-known/openid-configuration or oauth-authorization-server document is
  served on any Capitalist host (all probed 404 on 2026-09-05).

apis:
  - name: Capitalist Integration API (v2)
    base_url: https://api2.capitalist.net
    status: current
    docs: https://docs.capitalist.net/api/integration-api.html
    schemes:
      - id: api-key-signed
        type: apiKey
        in: header
        name: API-Key
        description: >-
          API key generated in the account's Security section
          (https://capitalist.net/security). The provider's docs state that API
          access must be enabled and Google 2FA activated on the account before
          a key can be created.
      - id: request-timestamp
        type: apiKey
        in: header
        name: X-Request-Timestamp
        description: Current timestamp in epoch milliseconds; also the anti-replay nonce.
      - id: request-signature
        type: apiKey
        in: header
        name: Signature
        description: >-
          sha256_hex(X-Request-Timestamp + raw request body + API secret), sent
          as a lowercase hex string. All three headers are required on every
          call.
    signing:
      algorithm: SHA-256
      encoding: hex
      formula: 'Signature = sha256_hex(X-Request-Timestamp + request_body + API-secret)'
      secret: API secret, issued alongside the API key in the account Security section
      replay_protection: >-
        The signature covers X-Request-Timestamp, so a captured request cannot be
        replayed with a different timestamp. The docs do not state a clock-skew
        tolerance window.
      docs: https://docs.capitalist.net/api/integration-api.html
    callback_verification:
      description: >-
        Outbound payment and KYC callbacks are signed with the SAME construction:
        the provider sends X-Request-Timestamp and Signature headers, and the
        integrator recomputes sha256_hex(timestamp + body + API secret) to verify
        authenticity.
      headers: [X-Request-Timestamp, Signature]
      docs: https://docs.capitalist.net/api/integration-api.html
    network_controls:
      ip_allowlist:
        supported: true
        description: >-
          API methods may be restricted to an allowlist of IP addresses; requests
          from IPs outside the list are rejected. Exact IPs and last-octet
          wildcards (e.g. 127.0.0.*) are accepted.
        endpoints:
          - GET /v1/whitelist
          - POST /v1/whitelist
          - POST /v1/whitelist/remove
        docs: https://docs.capitalist.net/api/integration-api.html
    account_prerequisites:
      - API access enabled on the account
      - Google Authenticator (2FA) activated on the account
      - API key and API secret created at https://capitalist.net/security
    live_probe:
      url: https://api2.capitalist.net/v1/rate?from=USD&to=EUR
      status: 401
      body: 'Missing `API-Key`'
      checked: '2026-09-05'

  - name: Capitalist Payments API (v1, deprecated)
    base_url: https://api.capitalist.net
    status: deprecated
    docs: https://capitalist.net/developers/deprecated/v1/api
    schemes:
      - id: form-credentials
        type: apiKey
        in: formData
        name: login
        description: Capitalist account username (not the account email), sent as a form field.
      - id: form-password
        type: apiKey
        in: formData
        name: password
        description: >-
          Plain password, an encrypted password, or a certificate-derived
          signature depending on the operation's verification level. The
          provider publishes PHP and Java reference implementations of the
          encryption and signing at https://github.com/capitalist-net.
      - id: one-time-token
        type: apiKey
        in: formData
        name: token
        description: One-time security token obtained via the get_token operation.
    live_probe:
      url: https://api.capitalist.net/
      status: 200
      note: >-
        GET returns 150;"Received a non-POST request. (API version 1.9.8)".
        A POST without the x-response-format header returns
        {"code":4,"message":"Only x-response-format=json is available."}; with
        the header it returns a validation error naming login, encrypted_password
        and token as required. Probed anonymously 2026-09-05.
      checked: '2026-09-05'

oauth:
  supported: false
  note: >-
    No OAuth 2.0 or OpenID Connect surface. /.well-known/openid-configuration
    and /.well-known/oauth-authorization-server return 404 on capitalist.net,
    api.capitalist.net and api2.capitalist.net (probed 2026-09-05). There is
    therefore no scopes/ artifact for this provider.

mtls:
  supported: false
  note: >-
    v1 uses client-held certificates to SIGN request payloads (see
    https://github.com/capitalist-net/Capitalist-API-Java-crypto), not for
    transport-layer mutual TLS.

maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com