Limepay · Authentication Profile

Limepay Authentication

Authentication

Limepay declares 3 security scheme(s) across its OpenAPI definitions.

PaymentsAustraliaBNPLPayment GatewayCheckoutEmbedded PaymentsWhite LabelCard PaymentsMarketplaceInstalments

Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

http

scheme: bearer · in: header ()

http

scheme: bearer · in: header ()

http

scheme: bearer · in: header ()

Source

Authentication Profile

generated: '2026-07-24'
method: derived
source: >-
  Documented Limepay authentication model as captured in apis.yml (developer
  portal docs.limepay.com.au now gated behind a Redocly login, so no live spec
  could be re-fetched). No OpenAPI available to run derive-authentication.py
  against; profile hand-derived from the historically public documentation.
summary: >-
  Limepay used three scoped API keys, each presented as an HTTP Bearer token.
  A Publishable key authorised frontend/checkout calls, a Secret key authorised
  server-to-server Payments API calls, and a Platform key authorised
  administrative marketplace/onboarding calls on the Platform API.
schemes:
- id: publishable_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Bearer <publishable_api_key>'
  audience: frontend / Checkout (browser-safe)
  applies_to: Limepay Checkout, client-side order/payment initiation
- id: secret_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Bearer <secret_api_key>'
  audience: server-to-server
  applies_to: Payments API (create/pay orders, capture/void, refunds, saved cards)
- id: platform_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Bearer <platform_api_key>'
  audience: platform administration
  applies_to: Platform API (sub-merchant onboarding, KYC, settlement reports, platform refunds)
oauth2: false
openid_connect: false
mutual_tls: false
notes: >-
  Keys were issued per environment (test vs live). No OAuth2/OIDC flow was
  documented; authorization is a static bearer API key with resource scope
  determined by which key is used.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/limepay-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.