WorldFirst · Authentication Profile

Worldfirst Authentication

Authentication

WorldFirst secures its APIs with signature and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

PaymentsUnited KingdomCross-BorderMoney TransferForeign ExchangePayoutsPayment GatewayE-CommerceMulti-CurrencyCard Issuing

Methods: signature, oauth2 Schemes: 2 OAuth flows: clientCredentials API key in: header

Security Schemes

RequestSignature signature

scheme: RSA256 · in: header ()

OAuth2AccessToken oauth2

scheme: bearer

Source

Authentication Profile

generated: '2026-07-24'
method: searched
source: https://developers.worldfirst.com/docs/alipay-worldfirst/cashier_payment/getting_started
docs: https://developers.worldfirst.com/docs/alipay-worldfirst/overview/apis
note: >-
  WorldFirst does not publish a downloadable OpenAPI, so this profile is captured
  from the developer documentation rather than derived from a spec. The gateway is
  Ant Group's Antom-style platform (open-sea/open-eu/open-na hosts, /amsin/api/v1
  paths). Every request is authenticated with an asymmetric digital signature; an
  OAuth 2.0 access token is additionally used on the Enterprise Solution.
summary:
  types: [signature, oauth2]
  signature_algorithms: [RSA256, ECC224]
  api_key_in: [header]
  oauth2_flows: [clientCredentials]
schemes:
- name: RequestSignature
  type: signature
  scheme: RSA256
  in: header
  header: Signature
  format: "algorithm=RSA256,keyVersion=1,signature=<base64(sign(content))>"
  signed_content: "<HTTP-METHOD> <request-URI>\n<Client-Id>.<request-time>.<request-body>"
  key_management: >-
    Partner generates an RSA (or ECC) key pair and uploads the public key in the
    Developer Center Key Management section (separately for sandbox and production).
    WorldFirst signs its asynchronous notifications so the partner verifies them
    with WorldFirst's public key.
  required_headers:
  - Client-Id        # merchant/partner identifier issued in the Developer Center
  - Signature        # RSA256/ECC224 signature over the canonical request
  - request-time     # request timestamp (replay protection)
  - Content-Type     # application/json
  sources: [docs: cashier_payment/getting_started]
- name: OAuth2AccessToken
  type: oauth2
  scheme: bearer
  description: >-
    The Enterprise Solution (World Account) additionally carries an OAuth 2.0
    Access-Token obtained through partner authorization; the Pay Solution (Cashier
    Payment) is signature-only. Scopes are not published in the public docs.
  sources: [docs: worldfirst_enterprise_solution/api_overview]
alternatives:
  ecc224: >-
    ECC224 is supported as an alternative to RSA256 for the request signature; the
    Signature header algorithm token changes accordingly (algorithm=ECC224,...).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/worldfirst-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.