Castle · Authentication Profile

Castle Authentication

Authentication

Castle secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanySecurityFraud PreventionBot DetectionDevice FingerprintingAccount TakeoverRisk ScoringIdentity

Methods: http Schemes: 1 OAuth flows: API key in: header

Security Schemes

apiSecretBasic http

scheme: basic

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://docs.castle.io/docs/integration-guide + https://docs.castle.io/docs/enterprise-using-events-api
docs: https://docs.castle.io/docs/integration-guide
summary:
  types:
  - http
  api_key_in:
  - header
  oauth2_flows: []
schemes:
- name: apiSecretBasic
  type: http
  scheme: basic
  description: >-
    Backend requests authenticate with HTTP Basic authentication. The API Secret
    is supplied as the HTTP Basic password (username left empty), i.e.
    `Authorization: Basic base64(":<API_SECRET>")`. The secret is configured
    server-side via the CASTLE_API_SECRET environment variable in the official
    SDKs. Client-side calls use a separate publishable App ID with the browser/
    mobile SDK to generate a short-lived request token; the secret is never
    exposed to the client.
  sources:
  - https://docs.castle.io/docs/integration-guide
notes:
- Base URL is https://api.castle.io.
- The Events API (enterprise) uses the same HTTP Basic [example key] scheme.
- No OAuth2 / OpenID Connect surface is documented; therefore no scopes/ artifact.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/castle-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.