Flywire · Authentication Profile

Flywire Authentication

Authentication

Flywire secures its APIs with apiKey across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyPaymentsCross-Border PaymentsFintechEducation PaymentsHealthcare PaymentsTravel PaymentsB2B PaymentsCheckoutWebhook

Methods: apiKey Schemes: 1 OAuth flows: API key in: header

Security Schemes

ApiKeyAuth apiKey

· in: header ()

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://developers.flywire.com/education/Content/api-basics.htm
notes: >-
  Flywire has no published OpenAPI (the api-platform openapi.json returns 401),
  so this profile is captured from the developer docs rather than derived. The
  Payments API authorizes with a single static API key sent in a request header;
  there is no OAuth/OIDC flow and therefore no scopes artifact. Webhook callbacks
  are separately authenticated by an HMAC-SHA256 signature computed with a shared
  secret (see asyncapi/flywire-payments-webhooks.yml).
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter_name: X-Authentication-Key
  description: >-
    Per-application API key obtained by registering with Flywire (contact
    Flywire support). Sent on every request as the X-Authentication-Key header.
  registration: Contact Flywire to register an application and receive an API key + Shared Secret.
  sources: [docs]
webhook_auth:
  header: X-Flywire-Digest
  algorithm: HMAC-SHA256 (base64-encoded hash of the request body + Shared Secret)
  secret: Shared Secret issued at application registration

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/flywire-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.