> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.redpincompany.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.redpincompany.com/_mcp/server.

# Authentication

> Learn how to authenticate with the Redpin APIs

> **Info**
>
> All Redpin APIs require authentication to secure your data and ensure proper access control.

Our APIs support two authentication methods depending on the context:

## API Key Authentication

Partner integrations and public APIs like the Property Transaction Fee API and Referrals API use API key authentication. Your API key should be included in the request header of every API call.

### How to Use API Keys

Include your API key in the `apikey` header with every request:

```
apikey: your_api_key
```

For example:

```bash
curl -X POST "https://api.currenciesdirect.com/v1/property-fees" \
  -H "apikey: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{ "property_country": "AUS", ... }'
```

> **Warning**
>
> Never expose your API key in client-side code. Always make API calls from your server.

### Obtaining an API Key

API keys are provided to approved partners. To request an API key:

1. Contact our Partner Integrations Team
2. Receive your unique API key for integration

#### Request access

Contact the Partner Integrations Team to start the access request process.

#### Receive API key

Once approved, you'll receive your unique API key.

#### Implement securely

Store your API key securely and never expose it in client-side code.

## OAuth 2.0 Authentication

For customer-facing APIs and higher-security operations, we use OAuth 2.0 with Client Credentials flow.

### OAuth 2.0 Client Credentials Flow

The Client Credentials flow is designed for server-to-server authentication:

1. Your application requests an access token using your client credentials
2. Our authorization server validates your credentials and issues an access token
3. Your application uses the access token to authenticate API requests

#### Requesting an Access Token

Make a POST request to our token endpoint:

```bash
curl -X POST "https://api.currenciesdirect.com/auth/oauth/v2/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"
```

The response will include an access token and expiration time:

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer",
  "expires_in": 3600
}
```

#### Using the Access Token

Include the access token in the Authorization header of your API requests:

```bash
curl -X GET "https://api.currenciesdirect.com/v1/customers" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
```

> **Warning**
>
> Access tokens expire after the time specified in the "expires_in" field. Your application should request a new token when the current one expires.

### Obtaining OAuth Credentials

OAuth client credentials are provided to partners who need access to customer-facing APIs. To request credentials:

1. Contact our Partner Integrations Team
2. Provide details about your integration use case
3. Complete the security review process
4. Receive your client ID and client secret

## API-Specific Authentication

Different APIs may require specific authentication approaches:

#### Partner APIs

The Property Transaction Fee API and Referrals API use API key authentication in the apikey header.

```
apikey: your_api_key
```

#### Customer APIs

Customer-facing APIs like Customer Management and Transactions use OAuth 2.0 authentication.

```
Authorization: Bearer your_access_token
```

## Security Best Practices

To maintain the security of your integration, follow these best practices:

* Store API keys and client secrets securely
* Implement proper key rotation procedures
* Use environment variables for storing sensitive credentials
* Never hardcode credentials in your application
* Implement rate limiting and monitoring for unusual activity
* Use HTTPS for all API requests

> **Info**
>
> For more detailed information about specific API authentication requirements, refer to the individual API documentation.