PayPay · Authentication Profile

Paypay Authentication

Authentication

PayPay secures its APIs with http and hmac across 2 declared security schemes, as derived from its OpenAPI definitions.

CompanyFintechPaymentsMobile PaymentsQR Code PaymentsDigital WalletJapanMerchant Payments

Methods: http, hmac Schemes: 2 OAuth flows: API key in:

Security Schemes

BasicAuth http

scheme: Basic

HmacOPA http

scheme: hmac

Source

Authentication Profile

generated: '2026-07-20'
method: searched
source: openapi/paypay-opa-openapi-original.json
docs: https://www.paypay.ne.jp/opa/doc/v1.0/api_authorization.html
summary:
  types:
  - http
  - hmac
  note: >-
    The OpenAPI declares a simplified BasicAuth (http Basic) security scheme, but
    the PayPay Open Payment API (OPA) is actually secured with a custom HMAC-SHA256
    request signature. Merchants obtain an API key + API secret from the PayPay
    Developer / Merchant Panel (separate keys per environment).
schemes:
- name: BasicAuth
  type: http
  scheme: Basic
  sources:
  - openapi/paypay-opa-openapi-original.json
- name: HmacOPA
  type: http
  scheme: hmac
  documented: true
  header: Authorization
  format: 'hmac OPA:{ApiKey}:{macData}:{nonce}:{epoch}:{hash}'
  algorithm: HMAC-SHA256
  parameters:
    api_key: API key generated in the Developer/Merchant Panel
    api_secret: API key secret generated in the Developer/Merchant Panel
    nonce: random string (recommended length 8)
    epoch: epoch seconds, validated server-side to be within 2 minutes
    hash: base64 HMAC over method + URI + content-type + epoch + nonce + body hash
  source: https://www.paypay.ne.jp/opa/doc/v1.0/api_authorization.html
merchant_scoping:
  note: >-
    Every request must also carry the merchant identifier, via the
    X-ASSUME-MERCHANT HTTP header or the ?assumeMerchant={MerchantId} query
    parameter (query takes precedence when both are supplied).
  header: X-ASSUME-MERCHANT
  query: assumeMerchant

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/paypay-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.