1. 🛡️ Security & Limits
Pix2DePix API
  • ⚡ Quickstart
  • Guides
    • 🔑 Authentication
    • 🔄 Possible Statuses
    • 🔀 Synchronous requests & safe retries
    • ⚠️ Errors & the response envelope
    • 🧩 Troubleshooting
    • ✅ Best Practices
    • 🚀 Features
      • ⏱️ QR Delay
    • 🛡️ Security & Limits
      • 🚦 API Limits
      • 🧱 Firewall
      • 🪲 Bug Bounty
  • API Endpoints
    • Ping
      GET
    • Deposit (PIX ➔ DePix)
      POST
    • Deposit Status
      GET
    • Deposits
      GET
    • User Info
      GET
    • Withdraw
      POST
    • Withdraw Status
      GET
  • Webhooks
    • 🪝 Webhooks
    • Deposit Webhook
    • Withdraw Webhook
    • MED Webhook
  • Reference
    • 📖 Glossary
    • 📝 Changelog
  • Schemas
    • JWTClaims
    • ErrorObj
    • PingObj
    • ErrorResponse
    • DepositObj
    • PingResponse
    • DepositResponse
    • DepositStatusObj
    • DepositStatusResponse
    • DepositWebhookBody
    • DepositsResponse
    • DepositStatus
    • UserInfoResponse
    • WithdrawStatusResponse
    • WithdrawStatusObj
    • WithdrawResponse
    • WithdrawObj
    • WithdrawStatus
    • WithdrawWebhookBody
    • MEDWebhookBody
    • RejectionReasons
  1. 🛡️ Security & Limits

🧱 Firewall

Your API token is the only credential to your account. Anyone who holds it can create deposits and withdrawals on your behalf. Keep it on your server, never ship it in an application your users can inspect, and contact our support team immediately if you suspect it was exposed.
Requests to https://depix.eulen.app/api are served through a CDN, which inspects incoming traffic and can reject a request before the API ever receives it.

Telling an edge rejection apart from an API error#

Every response the API itself produces is JSON and carries an errorMessage field, as described in Error Handling. A rejection at the edge does not: it never reaches the API, so it comes back without that field.
If you receive a response whose body is not JSON, the request was stopped before the API. Retrying it unchanged will give the same result. Contact our support team with the endpoint, the time of the request, your source IP address, and the value of the X-Amz-Cf-Id response header, which identifies that exact request in our edge logs.
Modified at 2026-08-24 14:27:34
Previous
🚦 API Limits
Next
🪲 Bug Bounty
Built with