Fipto Authentication

generated: '2026-08-17'
method: searched
source: https://docs.fipto.com/docs/api-authentication
docs: https://docs.fipto.com/docs/authentication-1
note: >-
  The published OpenAPI (openapi/fipto-customer-api-openapi.yml, info.version 4.3.0) declares NO
  components.securitySchemes at all, so nothing could be derived mechanically from the contract.
  The auth model below is transcribed from Fipto's own authentication guides. This is a real gap in
  the spec: an agent reading only the OpenAPI cannot tell how to authenticate.
summary:
  types: [httpSignature]
  api_key_in: []
  oauth2_flows: []
  declared_in_openapi: false
schemes:
- name: HTTP Message Signature
  type: httpSignature
  standard: draft-cavage-http-signatures-12
  standard_url: https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12
  algorithm: hs2019 (synonym rsa-sha256)
  key_material: RSA 2048 key pair generated by the client; the PUBLIC key is sent to Fipto during
    onboarding and Fipto issues an API user UUID used as the signature keyId.
  key_id: UUID of the API user issued by Fipto
  signed_headers:
  - (request-target)
  - host
  - date
  - content-type   # bodied requests only
  - digest         # bodied requests only
  required_headers:
  - name: Host
    description: Target host of the request (api.demo.fipto.tech for demo, api.fipto.app for production)
  - name: Date
    description: RFC 1123 timestamp; must be in the past but no more than 1 minute old
  - name: Signature
    description: 'keyId="<api user uuid>",algorithm="hs2019",headers="(request-target) host date content-type digest",signature="<base64>"'
  - name: Content-Type
    description: MIME type of the body; required on POST/PUT/PATCH
  - name: Digest
    description: SHA-256=<base64 sha256 of the raw body>; required on POST/PUT/PATCH
  sources: [https://docs.fipto.com/docs/api-authentication]
onboarding:
  self_serve: false
  process: >-
    Credentials are not self-serve. A prospective user requests access at https://www.fipto.com/demo,
    supplies an RSA public key, and Fipto issues the API user UUID and company id. Production
    credentials are issued only after KYB.
  request_access: https://www.fipto.com/demo
helpers:
- kind: postman
  description: Fipto publishes a public Postman collection whose pre-request script builds the
    Signature header, so the signing algorithm does not have to be implemented by hand to try the API.
  url: https://www.postman.com/galactic-meadow-917828/workspace/fipto-api-demo-environment/collection/24959087-42b9da95-ca00-4b9a-89cc-52d84d432d5f
  docs: https://docs.fipto.com/docs/postman-guide
- kind: mcp
  description: The open-source Fipto MCP server signs requests on the agent's behalf given USER_ID and
    PRIVATE_KEY environment variables.
  url: https://github.com/fipto/mcp-fipto
delegated_access:
  model: AISP/PISP
  description: >-
    Fipto exposes a separate delegated-access surface for Account Information Service Providers and
    Payment Initiation Service Providers under PSD2. An AISP/PISP is registered as its own API user
    against a company and gets scoped operations (payout initiation, wallet/transaction/beneficiary
    read) under /aisp-pisp/ paths.
  operations: [listAispPisp, createCompanyAispPisp, listCompanyAispPisp, getCompanyAispPisp,
    deleteCompanyAispPisp, initiatePayoutAispPisp, getWalletAispPisp, listWalletAispPisp,
    searchTransactionsAispPispByCompanyId, getTransactionAispPisp, listBeneficiariesAispPisp,
    getBeneficiaryAispPisp]
strong_authentication:
  required: true
  description: >-
    Some operations require two-factor verification. createAutomation is documented in the spec as
    "Requires 2FA verification". Fipto documents Strong Customer Authentication (PSD2 SCA) for
    platform users.
  docs: https://docs.fipto.com/docs/what-is-strong-authentication
webhook_authentication:
  direction: inbound-to-customer
  header: Fipto-Signature
  algorithm: Base64(RSASSA-PKCS1-v1_5(webhook private key, SHA-512, SHA-512(eventBody)))
  verification: Fipto publishes per-environment RSA public keys for signature verification
  docs: https://docs.fipto.com/docs/webhooks