Kanastra · Authentication Profile

Kanastra Authentication

Authentication

Kanastra secures its APIs with http and private_key_jwt across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyBankingBanking as a ServicePaymentsPIXBoletoPrivate CreditFintechBrazilWealth Management
Methods: http, private_key_jwt Schemes: 1 OAuth flows: API key in:

Security Schemes

bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
# generated: '2026-07-19'
generated: '2026-07-19'
method: searched
source: https://banking-docs.kanastra.com.br/
docs: https://banking-docs.kanastra.com.br/
summary:
  types:
  - http
  - private_key_jwt
  token_endpoint: /api/v1/auth/token
  registration_endpoint: /api/v1/auth/jwks
  assertion_alg: ES512
  bearer_ttl_seconds: 35999
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Bearer JWT access token obtained from POST /api/v1/auth/token. Token response includes
    tokenType=Bearer, expiresIn (~35999s / ~10h), and a space-delimited scope claim.
  sources:
  - openapi/kanastra-banking-openapi.yml
flow:
  style: private_key_jwt (client assertion)
  steps:
  - Register an ES512 (secp521r1) public key for your clientId via POST /api/v1/auth/jwks. Private key
    stays with the integrator.
  - Build and sign a JWT client assertion (clientAssertion) with the ES512 private key.
  - POST /api/v1/auth/token with {clientId, clientAssertion} to receive a Bearer access_token + scope.
  - 'Send Authorization: Bearer <access_token> on all subsequent calls.'
additional_controls:
- name: Transaction Hash Key
  algorithm: HMAC-SHA256 (hex-encoded)
  applies_to:
  - POST /api/v1/accounts/personal
  description: Account-creation endpoints require an HMAC-SHA256 hash of the request payload (shared secret
    provided by Kanastra at onboarding), hex-encoded and passed in request headers.
- name: PIX OTP
  description: PIX key registration approval/denial is confirmed with an OTP token (Approve/Deny/Resend
    OTP endpoints under PIX Keys).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/kanastra-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.