Modulr · Authentication Profile

Modulr Authentication

Authentication

Modulr secures its APIs with apiKey across 2 declared security schemes, as derived from its OpenAPI definitions.

PaymentsUnited KingdomBanking as a ServiceEmbedded FinancePayment ProcessingAccount-to-AccountOpen BankingFaster PaymentsCard IssuingDirect DebitConfirmation of PayeeVariable Recurring Payments

Methods: apiKey Schemes: 2 OAuth flows: API key in: header

Security Schemes

modulo_security apiKey

· in: header (Authorization)

TOKEN apiKey

· in: header (Authorization)

Source

Authentication Profile

generated: '2026-07-24'
method: searched
source: openapi/modulr-api.json
docs: https://modulr.readme.io/docs/authentication
summary:
  types:
  - apiKey
  api_key_in:
  - header
  model: HMAC request signing (draft HTTP Signatures) over an API Key + HMAC secret
schemes:
- name: modulo_security
  type: apiKey
  in: header
  parameter: Authorization
  sources:
  - openapi/modulr-api.json
- name: TOKEN
  type: apiKey
  in: header
  parameter: Authorization
  note: >-
    Sandbox-only bearer token shortcut. Uses the base URL
    https://api-sandbox.modulrfinance.com/api-sandbox-token/ and the raw API Key
    as the Authorization value. Not accepted in production.
  sources:
  - openapi/modulr-api.json
details:
  production_auth: HMAC
  hmac:
    standard: HMAC HTTP request signing (latest draft of the HMAC request-signing standard)
    algorithm: hmac-sha1
    signed_headers:
    - date
    - x-mod-nonce
    authorization_format: >-
      Signature keyId="<API_KEY>",algorithm="hmac-sha1",headers="date x-mod-nonce",signature="<url-encoded-base64>"
    credentials:
    - API Key (aka token)
    - API HMAC Secret (aka hmac/secret)
    required_headers:
    - name: Date
      note: RFC 7231 HTTP-date, GMT (e.g. "Mon, 25 Jul 2016 16:36:07 GMT")
    - name: x-mod-nonce
      note: unique value per request; reused only for idempotent retries
    - name: Authorization
      note: the Signature header
    clock_skew: enforced (recommended NTP sync) to prevent replay attacks
  ip_allowlisting: Production API access is restricted by IP address (allowlist requested at onboarding)
  transport: HTTPS required in all environments
  sample_code: https://github.com/Modulr-finance/modulr-hmac

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/modulr-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.