Cora · Authentication Profile

Cora Authentication

Authentication

Cora secures its APIs with oauth2 and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyBankingBrazilPaymentsPixBoletoInvoicingSMBFintechBanking-as-a-Service

Methods: oauth2, mutualTLS Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

mutualTLS mutualTLS

OAuth2ClientCredentials oauth2

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://developers.cora.com.br/docs/client-credentials-int-direta
docs: https://developers.cora.com.br/docs/client-credentials-int-direta
summary:
  types:
  - oauth2
  - mutualTLS
  oauth2_flows:
  - clientCredentials
  notes: >-
    Cora offers two integration modalities. Direct Integration (Integração Direta)
    requires mutual TLS: every request must present an X.509 client certificate and
    private key issued by Cora, in addition to an OAuth2 client-credentials bearer
    token obtained from the /token endpoint. Cora Partnership (Parceria Cora) uses
    OAuth2 client-credentials with a client secret (no client certificate). Credentials
    are provisioned through the Cora app or Cora Web, not self-service.
schemes:
- name: mutualTLS
  type: mutualTLS
  description: >-
    Client certificate (certificate.pem) + private key (private-key.key) presented
    on every request for the Direct Integration modality (matls-clients hosts).
  modality: direct-integration
  sources:
  - docs:developers.cora.com.br/docs/client-credentials-int-direta
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_url_stage: https://matls-clients.api.stage.cora.com.br/token
  token_url_production: https://matls-clients.api.cora.com.br/token
  grant_type: client_credentials
  token_type: Bearer
  request_content_type: application/x-www-form-urlencoded
  parameters:
  - client_id
  description: >-
    POST grant_type=client_credentials&client_id=<client_id> to /token (presenting
    the client certificate + key for Direct Integration) to receive a Bearer access
    token used in the Authorization header of subsequent API calls.
  sources:
  - docs:developers.cora.com.br/docs/client-credentials-int-direta

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cora-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.