Gr4vy · Authentication Profile

Gr4Vy Authentication

Authentication

Gr4vy secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the password flow(s).

PaymentsPayment OrchestrationFintechCheckoutTokenizationVaultFraud Prevention3D SecureWebhookCommerceA2A

Methods: http, oauth2 Schemes: 2 OAuth flows: password API key in:

Security Schemes

bearerAuth http

scheme: bearer

OAuth2PasswordBearer oauth2

· flows: password

Source

Authentication Profile

generated: '2026-09-20'
method: searched
source: openapi/gr4vy-docs-v1-openapi.yml, openapi/gr4vy-openapi.yml + https://docs.gr4vy.com/guides/api/authentication
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - password
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  sources:
  - openapi/gr4vy-docs-v1-openapi.yml
- name: OAuth2PasswordBearer
  type: oauth2
  flows:
  - flow: password
    tokenUrl: auth/token
    scopes: 86
  sources:
  - openapi/gr4vy-openapi.yml
docs:
- https://docs.gr4vy.com/guides/api/authentication
- https://docs.gr4vy.com/guides/api/jwts
- https://docs.gr4vy.com/guides/api/api-keys
notes:
  model: Bearer JWT created server-side and signed with an API key-pair private key from the dashboard Integrations
    panel (or provisioned over the API-key-pairs API).
  algorithms:
  - ES512 (recommended)
  - RS512
  jwt_header: typ and alg are fixed; kid is the key thumbprint
  required_claims:
  - iss
  - nbf
  - exp
  - jti
  - scopes
  optional_claims:
  - iat
  - embed
  frontend: A JWT with the embed scope (pinning amount/currency/buyer) or a Checkout Session ID is used by Embed
    / Secure Fields; those tokens are rate-limited for enumeration prevention.
  spec_discrepancy: The GitHub OpenAPI labels the scheme OAuth2PasswordBearer (oauth2 password flow, tokenUrl auth/token
    - the dashboard user login the CLI also supports); the docs-hosted v1 spec labels it http bearer JWT. The documented
    integration path is the self-signed JWT.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/gr4vy-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.