Authentication

The BRZ API uses two authentication methods depending on the endpoint type.

1. Bearer Token (JWT) — Most Endpoints

All endpoints except Cash-In use Bearer Token authentication:

$
Authorization: Bearer <your-jwt-token>

Obtaining a JWT

Call POST /api/v1/auth/bearer-token with your API Key credentials in the headers and the desired scopes in the request body:

$
curl -X POST https://api.brzip.com.br/api/v1/auth/bearer-token \
>
  -H "Content-Type: application/json" \
>
  -H "x-key-id: your-key-id" \
>
  -H "x-secret-key: your-secret-key" \
>
  -d '{
>
    "scopes": [
>
      "pix:keys:read",
>
      "pix:keys:write",
>
      "pix:balance:read",
>
      "pix:cashout:write",
>
      "webhooks:read",
>
      "webhooks:write"
>
    ]
>
  }'

Response:

1
{
2
  "success": true,
3
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
4
  "expires_in": 3600
5
}

The returned JWT token should be included in the Authorization header as Bearer <token> for all subsequent requests.

2. API Key — Cash-In Endpoints

The Cash-In endpoint (POST /api/v1/pix/cash-in/qrcode) accepts API Key authentication via two headers as an alternative to Bearer Token:

$
x-key-id: <your-key-id>
$
x-secret-key: <your-secret-key>

Example

$
curl -X POST https://api.brzip.com.br/api/v1/pix/cash-in/qrcode \
>
  -H "Content-Type: application/json" \
>
  -H "x-key-id: your-key-id" \
>
  -H "x-secret-key: your-secret-key" \
>
  -d '{
>
    "amount": "150.00",
>
    "description": "Payment for order #123"
>
  }'

Available Scopes

When generating a Bearer Token, you can request specific scopes to control access. If no scopes are provided, the token will include all scopes available to your API Key.