generated: '2026-07-17'
method: searched
source: openapi/appcharge-openapi.yml + https://docs.appcharge.com/api-reference/appcharge-publisher-secure-communication + https://docs.appcharge.com/merchant-of-record/security/about-security-at-appcharge
docs: https://docs.appcharge.com/api-reference/appcharge-publisher-secure-communication
description: >-
  Appcharge uses three distinct authentication surfaces: (1) the publisher REST
  API authenticates with the x-publisher-token API key header (from the
  Publisher Dashboard > Settings > Integration); (2) webhooks and Appcharge->
  publisher callbacks are verified with an HMAC-SHA256 signature over
  "{timestamp}.{json_payload}" carried in the `signature: t=...,v1=...` header
  (plus x-publisher-token and x-project-id), with a ~5-minute replay window;
  (3) the hosted MCP server is protected by OAuth 2.0 (authorization_code +
  PKCE). mTLS is supported for sensitive server-to-server integrations.
summary:
  types: [apiKey, oauth2, mutualTLS, hmac-signature]
  api_key_in: [header]
  api_key_names: [x-publisher-token]
  oauth2_flows: [authorizationCode]
schemes:
  - name: PublisherTokenAuth
    type: apiKey
    in: header
    parameter: x-publisher-token
    description: >-
      Publisher token from the Publisher Dashboard (Settings > Integration).
      Required on all REST API calls. Can be shared across multiple Appcharge
      accounts.
    sources: [openapi/appcharge-openapi.yml]
  - name: WebhookSignature
    type: hmac
    algorithm: HMAC-SHA256
    header: signature
    format: t={timestamp},v1={hex_signature}
    input: "{timestamp}.{json_payload}"
    replay_window: ~5 minutes
    also_sent: [x-publisher-token, x-project-id]
    description: >-
      Signature Appcharge attaches to every outbound webhook/callback so the
      publisher can verify authenticity and integrity. Timestamp is a Unix ms
      value; publishers reconstruct the HMAC with their main key (Settings >
      Integration) and compare.
    sources: [https://docs.appcharge.com/api-reference/events/v2/introduction]
  - name: OAuth2
    type: oauth2
    flow: authorizationCode
    authorizationUrl: https://api.appcharge.com/oauth/authorize
    tokenUrl: https://api.appcharge.com/oauth/token
    scopes: [mcp:read, mcp:write]
    applies_to: hosted MCP server (mcp.appcharge.com)
    sources: [https://api.appcharge.com/.well-known/oauth-authorization-server]
  - name: MutualTLS
    type: mutualTLS
    description: >-
      mTLS supported for server-to-server integrations that require both parties
      to present and verify certificates.
    sources: [https://docs.appcharge.com/merchant-of-record/security/about-security-at-appcharge]