Everclear · Authentication Profile

Connext Authentication

Authentication

Everclear declares 0 security scheme(s) across its OpenAPI definitions.

CompanyBlockchainCryptocurrencyWeb3InteroperabilityCross-ChainBridgingSettlementLiquidityIntentsDeFiChain AbstractionDefunct

Methods: Schemes: 0 OAuth flows: API key in:

Security Schemes

Source

Authentication Profile

generated: '2026-08-09'
method: derived
source: openapi/connext-everclear-openapi.yml, https://docs.everclear.org/developers/api.md
summary: >-
  The Everclear ("Chimera") API declares no authentication at all. The merged OpenAPI carries
  no components.securitySchemes block and no security requirement on any of its 17
  operations, and the docs never mention an API key, token, or account. Authorization in
  Everclear is on-chain: the REST API only reads indexed protocol state and builds unsigned
  EVM/Solana/Tron TransactionRequest objects, which the caller then signs with their own
  wallet key and submits to the chain themselves. The signing key never touches Everclear.
model: none
schemes: []
security_requirements: []
findings:
  - id: no-security-schemes
    detail: components.securitySchemes is absent from every one of the 17 published OpenAPI documents.
  - id: no-operation-security
    detail: No operation declares a security[] requirement; all 17 are anonymous.
  - id: authorization-is-on-chain
    detail: >-
      POST /intents, POST /solana/intents and POST /tron/intents return a TransactionRequest
      (to/data/value/chainId or the chain equivalent) for the caller to sign locally. The
      caller's private key is the only credential in the flow and it is never sent to the API.
  - id: permit2-signature-in-body
    detail: >-
      IntentRequest accepts an optional permit2Params object (nonce, deadline, signature) —
      an EIP-2612/Permit2 signature produced client-side. This is a token-approval signature
      carried in the request body, not an API credential.
  - id: no-oauth-no-oidc
    detail: >-
      No /.well-known/openid-configuration or /.well-known/oauth-authorization-server on any
      host; scopes/ is therefore not applicable and is not emitted.
docs: https://docs.everclear.org/developers/api
caveat: >-
  Unverifiable against a live host: https://api.everclear.org returned HTTP 530 on 2026-08-09,
  so this profile is derived from the published contract only. See lifecycle/connext-lifecycle.yml.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/connext-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.