📝 Changelog

Track every breaking and notable change to the Pix2Depix API here. We recommend partners subscribe to this page and review it before any rollout — backward-incompatible changes are announced here first.

How to read this page

Entries are in reverse-chronological order. Each change is tagged Added, Changed, Removed, or Deprecated. Some historical entries are marked (date to confirm) while we finalize their exact release date — the change itself is already live in production.

2026-08-21

Changed — A refund sent to refundAddress now withholds a fee of 1 DePix when the payout could not be completed because of the request itself: the Pix key does not belong to the informed taxNumber, or the Pix key is invalid or was rejected at payout. The fee comes out of the amount returned. No fee is withheld when the failure was not on the request: our side or the banking processor broke, or the DePix that arrived did not match what the withdrawal expected. See Withdraw.

2026-08-07

Added — refundAddress on POST /withdraw. An optional Liquid address where your DePix is returned if the withdrawal cannot be completed. It has to be sent on the request and cannot be supplied afterwards: without it, a failed withdrawal waits until our team can reach you to ask where to send the funds. The recorded value comes back on GET /api/withdraw-status. See Withdraw.

Added — Client credentials. /addclientcredentials <label> [<scope>] on Telegram issues a client_id / client_secret pair, which you exchange at POST /api/v2/auth/login for a short-lived access token plus a rotating refresh token; renew at POST /api/v2/auth/refresh and end a session at POST /api/v2/auth/logout. Manage the pairs with /listclientcredentials and /removeclientcredentials <label>. See Authentication.
/apitoken and existing long-lived tokens are unaffected and there is no migration deadline.

Why the change

A long-lived token that leaks stays useful to whoever holds it until it expires — up to a year. An access token minted from client credentials is useful for minutes, and the credential behind it can be revoked from Telegram at any time.

2026-06-12

Removed — The legacy asynchronous request model is gone. The API is now synchronous-only: X-Async: true is rejected with 400 ("X-Async: true is no longer supported"), and there is no more 202 Accepted / urlResponse polling. A slow request now surfaces as a 503 timeout. See Synchronous requests & safe retries.

2026-06-11

Removed — Some legacy documentation pages have been retired from the public API reference. The reference now lists only currently-supported endpoints.

Documentation cleanup

The reference is the supported surface. If something you integrated against is not listed here, treat it as unsupported and move off it — anything not documented can change or stop working without a changelog entry.

2026-05-26

Added — merchantId (the Merchant ID / EMID) is now accepted as an optional field on POST /deposit.

2026-05-01

Changed — POST /withdraw now requires beneficiary identification. Send at least one of taxNumber (CPF/CNPJ of the Pix key owner) or euid. If you send both, they must match — the request is rejected outright when they disagree.

Action required

If you integrated POST /withdraw before this date, update your calls to include taxNumber and/or euid. Requests without beneficiary identification are rejected.

2026-01-13

Added — QR Delay on POST /deposit. Set delayDepixInHours (integer, 1–720) to hold a deposit until a later time instead of processing it immediately. When set, GET /deposit-status returns delayUntil (ISO 8601) indicating when the deposit will be processed, and the deposit reports the delayed status until then.

2026-08-21#

2026-08-07#

2026-06-12#

2026-06-11#

2026-05-26#

2026-05-01#

2026-01-13#