Authentication - Bringin Partner API

All API requests require an api-key header:

api-key: ZTY3YzNhMzQ3Yzk4NGJjMmEwZWU1NTQ4NmE5MjJjZTk=

Two Types of Keys

Key	What it’s for	How to get it
Master key	Onboarding users, getting signup links, checking rates	Provided by Bringin during partner setup
Per-user key	Creating orders, checking balance, listing transactions, managing connections	Returned after connecting a user (via API response or webhook)

The master key identifies your application. The per-user key identifies a specific user within your app.

Per-user keys have limited permissions — they can only push crypto for conversion. Safe to store on client devices.

When is HMAC needed?

Only when you call POST /application/connect with a callback URL (webhook-enabled onboarding). HMAC proves the request came from your server. If you don’t use webhooks, you don’t need HMAC. See HMAC Signing for the step-by-step process.

Headers

Both api-key and x-api-key are accepted. Keys may optionally have prefixes (pk_live_, sk_test_, etc.) — these are stripped automatically.

Introduction HMAC Signing

​Two Types of Keys

​When is HMAC needed?

​Headers

Two Types of Keys

When is HMAC needed?

Headers