DePix App · Authentication Profile

Depixapp Com Authentication

Authentication

DePix App secures its APIs with http and signed-request across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanyPaymentsPixStablecoinsCryptocurrencyBitcoinLiquid NetworkBrazilMCP
Methods: http, signed-request Schemes: 3 OAuth flows: API key in:

Security Schemes

apiKey http
scheme: bearer
agentSignedRequest signed-request
mcpOAuth oauth2

Source

Authentication Profile

Raw ↑ 
generated: '2026-11-05'
method: searched
source: https://depixapp.com/docs/en/#auth
docs: https://depixapp.com/docs/en/#auth
summary:
  types:
  - http
  - signed-request
schemes:
- name: apiKey
  type: http
  scheme: bearer
  description: 'Authorization: Bearer sk_live_<key> (production) or sk_test_<key> (sandbox). Maximum of 5 live keys and 5 test keys active per account. Keys carry immutable scopes (merchant_read, merchant_write, wallet_read, wallet_write); wallet_write keys carry mandatory spending limits. Key shown only once at creation. sk_live_ keys require manual approval ("Solicitar acesso").'
  key_prefixes:
  - sk_live_
  - sk_test_
  sources:
  - openapi/depixapp-com-openapi.yml
  - https://depixapp.com/docs/en/#auth
- name: agentSignedRequest
  type: signed-request
  algorithm: Ed25519
  description: The /api/agents/* endpoints do not use a static API key; every request is signed with the account's Ed25519 key. Canonical string (newline-joined) = depix-agent-auth:v1, api.depixapp.com, METHOD, path-without-query, timestamp, nonce, sha256hex(raw body).
  headers:
  - x-agent-public-key
  - x-agent-signature
  - x-agent-nonce
  - x-agent-timestamp
  constraints: nonce single-use, valid ~11 min; timestamp within ±300s of server time
  errors: [agent_invalid_signature, agent_signature_expired, agent_replay_detected, agent_unknown_key]
  declared_in_openapi: false
  sources:
  - https://depixapp.com/docs/en/#agents
- name: mcpOAuth
  type: oauth2
  description: The hosted MCP gateway (https://mcp.depixapp.com/mcp) accepts an OAuth 2.1 connector sign-in (claude.ai / ChatGPT) or a Bearer sk_ key. OAuth sessions are capped to read + merchant scopes and can never move money.
  declared_in_openapi: false
  sources:
  - https://depixapp.com/llms.txt
webhook_signing:
  header: X-DePix-Signature
  format: t=<unix-ts>,v1=<hmac-sha256-hex>
  signed_string: timestamp.payload
  secret: Webhook Secret from My Business
  docs: https://depixapp.com/docs/en/#webhook-verify

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/depixapp-com-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.