generated: '2026-08-30'
method: searched
source: >-
  https://docs.tronzap.com/api/authentication.html and
  https://docs-wallets.tronzap.com/api/ (Required headers), fetched 2026-08-30
docs: https://docs.tronzap.com/api/authentication.html
note: >-
  TronZap has no OpenAPI, so this profile is read from the published authentication
  reference rather than derived from securitySchemes. Two surfaces with opposite postures:
  the account API is bearer + HMAC-signed, the wallet Orders API is completely
  unauthenticated.
schemes:
- name: bearer_token
  api: TronZap REST API
  type: http
  scheme: bearer
  in: header
  parameter: Authorization
  format: 'Authorization: Bearer <API_TOKEN>'
  description: >-
    API token issued from the TronZap Dashboard (dash.tronzap.com) under the API section.
    Required on every /v1/* account endpoint.
  source: https://docs.tronzap.com/api/authentication.html
- name: request_signature
  api: TronZap REST API
  type: apiKey
  in: header
  parameter: X-Signature
  algorithm: SHA-256
  description: >-
    Body-integrity signature accompanying the bearer token. Computed as
    sha256(raw_request_body + api_secret), hex-encoded. The provider publishes the identical
    construction in Bash, Node.js, PHP and Python. The secret is never transmitted, so this
    is a shared-secret HMAC-style construction rather than an ordinary API key.
  formula: sha256(<raw JSON request body> + <API_SECRET>)
  encoding: lowercase hex
  source: https://docs.tronzap.com/api/authentication.html
- name: none
  api: TronZap Wallet Orders API
  type: none
  description: >-
    The Orders API for non-custodial wallet integrations is explicitly public. The provider
    states "No authentication headers are required. The Orders API is fully public." Only
    Content-Type and Accept are required. Attribution is carried by an optional
    referral_code field in the request body, which credits partner commission but grants
    no access.
  source: https://docs-wallets.tronzap.com/api/
required_headers:
  account_api:
  - 'Authorization: Bearer YOUR_API_TOKEN'
  - 'X-Signature: YOUR_SIGNATURE'
  - 'Content-Type: application/json'
  orders_api:
  - 'Content-Type: application/json'
  - 'Accept: application/json'
credential_issuance:
  console: https://dash.tronzap.com/
  path: Dashboard -> API section -> copy API token and secret
  self_service: true
  registration_required_for_orders_api: false
observations:
- >-
  The signature covers the exact serialized request body, so any client that re-serializes
  JSON between signing and sending will fail with error code 1 (auth). The provider does not
  publish a canonicalization rule, which makes this the most likely integration failure.
- >-
  There is no OAuth2, no OpenID Connect, no mutual TLS and no scope model on either surface.
  Authorization is all-or-nothing per token.
- >-
  Authentication errors are returned as HTTP 200 with body code 1 / key "auth", not as a 401.
summary:
  auth_types: [http-bearer, shared-secret-signature, none]
  api_key_locations: [header]
  oauth2_flows: []
  scopes_documented: false
  surfaces_authenticated: 1
  surfaces_public: 1