GCash · Authentication Profile

Gcash Authentication

Authentication

GCash secures its APIs with signature and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanyPaymentsMobile WalletE-MoneyFintechDigital PaymentsPhilippinesQR Payments

Methods: signature, oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

RequestSignature signature

UserAuthorization oauth2

PortalCredentials apiKey

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/call_api
docs:
- https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/call_api
- https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/api_openapi_userauthorization
- https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/v2_applytoken
- https://gcash.com/business/api-portal-faqs
summary:
  types: [signature, oauth2]
  model: >-
    GCash Mini Program Open API uses per-request digital-signature
    authentication (asymmetric key pair per partner) plus an OAuth2
    authorization-code style user-authorization flow that mints access tokens
    for user-scoped operations. The partner API Portal issues client
    credentials after subscription approval.
schemes:
- name: RequestSignature
  type: signature
  location: header
  headers:
  - Client-Id
  - Request-Time
  - Signature
  signature:
    algorithms: [RSA256, ECC224]
    default: RSA256
    key_version: keyVersion (defaults to latest key bound to Client-Id)
    request_time_format: ISO 8601, millisecond precision (e.g. 2019-05-28T12:12:12+08:00)
  notes: >-
    Every Open API call is signed. The Signature header is a comma-separated
    key=value string carrying algorithm, keyVersion and the signature value.
    Keys are bound to the partner Client-Id and generated in the API Portal
    "Request Credentials" wizard.
  source: https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/call_api
- name: UserAuthorization
  type: oauth2
  flow: authorizationCode
  steps:
  - my.getAuthCode / user authorization consent yields an authCode
  - POST /v{1,2}/authorizations/applyToken exchanges authCode for accessToken
  scopes_documented: [USER_INFO, USER_LOGIN_ID, USER_BASE_INFO]
  notes: >-
    Scopes above are the user-information capability scopes named in the
    mini-program authorization docs; the full scope reference is partner-gated.
  source: https://miniprogram.gcash.com/docs/miniprogram_gcash/mpdev/api_openapi_userauthorization
- name: PortalCredentials
  type: apiKey
  location: partner-portal-issued
  notes: >-
    Partner applications receive credentials via the GCash API Portal after
    subscribing to an API product and being approved. Portal login is
    email-based; production apiportal.gcash.com, sandbox apiportal.lab.gcash.com.
  source: https://gcash.com/business/api-portal-faqs

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/gcash-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.