Coinflow · Authentication Profile

Coinflow Authentication

Authentication

Coinflow secures its APIs with apiKey across 7 declared security schemes, as derived from its OpenAPI definitions.

CompanyCryptoPaymentsStablecoinUSDCCheckoutPayoutsMarketplaceWeb3Fintech

Methods: apiKey Schemes: 7 OAuth flows: API key in: header

Security Schemes

wallet apiKey

· in: header (x-coinflow-auth-wallet)

blockchain apiKey

· in: header (x-coinflow-auth-blockchain)

userId apiKey

· in: header (x-coinflow-auth-user-id)

merchant apiKey

· in: header (Authorization)

signedMessage apiKey

· in: header (x-coinflow-auth-signed-message)

merchantId apiKey

· in: header (x-coinflow-auth-merchant-id)

sessionKey apiKey

· in: header (x-coinflow-auth-session-key)

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: openapi/coinflow-openapi-original.json
docs: https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
summary:
  types:
  - apiKey
  api_key_in:
  - header
  model: >-
    Multi-layered header auth. Server-to-server requests carry the merchant API
    key in the Authorization header. End-user context is established either by a
    session key (call get-session-key with x-coinflow-auth-user-id, then pass
    x-coinflow-auth-session-key; session keys last 24 hours) or by web3 wallet
    verification (x-coinflow-auth-wallet + x-coinflow-auth-blockchain, proven with
    a signature in x-coinflow-auth-signed-message and confirmed via verify-token).
    No OAuth2/OIDC.
  session_ttl: 24 hours
schemes:
- name: wallet
  type: apiKey
  in: header
  parameter: x-coinflow-auth-wallet
  description: The web3 wallet of the end user - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
  sources:
  - openapi/coinflow-openapi-original.json
- name: blockchain
  type: apiKey
  in: header
  parameter: x-coinflow-auth-blockchain
  description: The blockchain associated with the end user - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
  sources:
  - openapi/coinflow-openapi-original.json
- name: userId
  type: apiKey
  in: header
  parameter: x-coinflow-auth-user-id
  description: The external identifier of the end user - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
  sources:
  - openapi/coinflow-openapi-original.json
- name: merchant
  type: apiKey
  in: header
  parameter: Authorization
  description: The API key of the merchant - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
  sources:
  - openapi/coinflow-openapi-original.json
- name: signedMessage
  type: apiKey
  in: header
  parameter: x-coinflow-auth-signed-message
  description: The message signed by the users wallet
  sources:
  - openapi/coinflow-openapi-original.json
- name: merchantId
  type: apiKey
  in: header
  parameter: x-coinflow-auth-merchant-id
  description: The merchant ID the session should be generated for
  sources:
  - openapi/coinflow-openapi-original.json
- name: sessionKey
  type: apiKey
  in: header
  parameter: x-coinflow-auth-session-key
  description: The session key generated for the end user - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key
  sources:
  - openapi/coinflow-openapi-original.json

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/coinflow-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.