Developers

API-first infrastructure for Brazilian fintechs.

Build with Swepay APIs. mTLS certificates today, identity and passwordless on the way. REST, JSON, JWT, sa-east-1. No SDK lock-in, no proprietary protocols, no enterprise floor.

Quickstart

From subscription to first certificate in five minutes.

Subscribe to CA Manager on AWS Marketplace, receive your tenant credentials, initialize your CA, and issue the first certificate, all via REST.

1. 1. Subscribe via AWS Marketplace

   Pick the tier that fits your volume. You can change tiers later without losing data.

   After subscription, you receive your tenantId and a JWT bearer token via the Marketplace welcome email. The JWT is what authenticates all API calls.

2. 2. Initialize your CA

   One-time setup. Generates your tenant's root Certificate Authority. Root key stays in managed cryptographic custody within Swepay infrastructure, not extractable, not accessible to operators in normal operations.

   bash

   curl -X POST https://ca.swepay.com.br/v1/ca/initialize \
     -H "Authorization: Bearer ${SWEPAY_JWT}" \
     -H "Content-Type: application/json" \
     -d '{
       "commonName": "Your Fintech Root CA",
       "organization": "Your Fintech S.A.",
       "country": "BR",
       "validityYears": 10
     }'

3. 3. Issue your first certificate

   Identity attributes go in, certificate plus private key come out, in four delivery formats on the same response.

   bash

   curl -X POST https://ca.swepay.com.br/v1/certificates \
     -H "Authorization: Bearer ${SWEPAY_JWT}" \
     -H "Content-Type: application/json" \
     -d '{
       "clientId": "partner_001",
       "commonName": "partner.example.com",
       "organization": "Partner Inc",
       "country": "BR",
       "validityDays": 365,
       "responseFormat": "Text",
       "passwordProtected": true
     }'

4. 4. Hand the certificate to your partner

   Pick the delivery format that fits your partner's runtime. PEM for most Unix/Linux stacks. PFX (PKCS#12) with the generated password for Windows/.NET, Java keystores, or mobile.

From here, the full lifecycle, query status, renew, revoke, list, monitor expiring, is just more API calls. The full reference is below.

Architecture

Two API surfaces, separated by purpose.

CA Manager exposes two distinct API surfaces. Each has its own domain, its own auth model, its own caching strategy. This separation matters when you're operating PKI at production scale.

Downtime of the administrative API does not break revocation validation on partner side. Your partners' mTLS clients continue to validate against the CDN even if the issuance API is undergoing maintenance. This is how PKI infrastructure is supposed to be built.

API reference

Administrative API endpoints.

Base URL: https://ca.swepay.com.br. All requests authenticated with Authorization: Bearer <JWT>. Content type: application/json. Errors follow RFC 7807 Problem Details format.

Full OpenAPI spec at ca.swepay.com.br/docs/openapi.json, load it into Postman, Insomnia, Bruno, or any OpenAPI-compatible tool.

PKI infrastructure

Revocation and trust artifacts on the CDN.

Base URL: https://ca-cdn.swepay.com.br. Public, no authentication. Aggressive edge caching with HTTP Last-Modified and ETag headers. Use these endpoints from your partners' mTLS clients, not from your administrative backend.

# Step 1: Fetch the CA cert
curl https://ca-cdn.swepay.com.br/v1/tenants/${TENANT_ID}/ca.pem > ca.pem

# Step 2: Validate a partner certificate via OCSP
openssl ocsp \
  -issuer ca.pem \
  -cert partner-cert.pem \
  -url https://ca-cdn.swepay.com.br/v1/tenants/${TENANT_ID}/ocsp \
  -resp_text

Authentication

JWT bearer, per tenant.

The administrative API uses JWT bearer tokens issued by Swepay's identity provider. After subscribing on AWS Marketplace, you receive your tenant credentials and JWT via the welcome email. PKI infrastructure endpoints (CDN) require no authentication.

Error model

RFC 7807 Problem Details, end to end.

Errors are returned as application/problem+json per RFC 7807. HTTP status code reflects the class of error; the body has machine-readable details.

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

{
  "type": "https://ca.swepay.com.br/errors/validation",
  "title": "Validation failed",
  "status": 400,
  "detail": "ValidityDays must be greater than 0",
  "errors": [
    { "field": "validityDays", "message": "Must be greater than 0" }
  ]
}

Under the hood

What's running behind the API.

If you're going to integrate with us, you'll want to know what's powering the responses you get back.

Build with Swepay.