📝 Changelog

Track every breaking and notable change to the Pix2Depix API here. We recommend partners subscribe to this page and review it before any rollout — backward-incompatible changes are announced here first.

How to read this page

Entries are in reverse-chronological order. Each change is tagged Added, Changed, Removed, or Deprecated. Some historical entries are marked (date to confirm) while we finalize their exact release date — the change itself is already live in production.

2026-08-07

Added — Client credentials. /addclientcredentials <label> [<scope>] on Telegram issues a client_id / client_secret pair, which you exchange at POST /api/v2/auth/login for a short-lived access token plus a rotating refresh token; renew at POST /api/v2/auth/refresh and end a session at POST /api/v2/auth/logout. Manage the pairs with /listclientcredentials and /removeclientcredentials <label>. See Authentication.
/apitoken and existing long-lived tokens are unaffected and there is no migration deadline.

Why the change

A long-lived token that leaks stays useful to whoever holds it until it expires — up to a year. An access token minted from client credentials is useful for minutes, and the credential behind it can be revoked from Telegram at any time.

2026-06-12

Removed — The legacy asynchronous request model is gone. The API is now synchronous-only: X-Async: true is rejected with 400 ("X-Async: true is no longer supported"), and there is no more 202 Accepted / urlResponse polling. A slow request now surfaces as a 503 timeout. See Synchronous requests & safe retries.

2026-06-11

Removed — Some legacy documentation pages have been retired from the public API reference. The reference now lists only currently-supported endpoints.

Documentation cleanup

The reference is the supported surface. If something you integrated against is not listed here, treat it as unsupported and move off it — anything not documented can change or stop working without a changelog entry.

2026-05-26

Added — merchantId (the Merchant ID / EMID) is now accepted as an optional field on POST /deposit.

2026-05-01

Changed — POST /withdraw now requires beneficiary identification. Send at least one of taxNumber (CPF/CNPJ of the Pix key owner) or euid. If you send both, they must match — the request is rejected outright when they disagree.

Action required

If you integrated POST /withdraw before this date, update your calls to include taxNumber and/or euid. Requests without beneficiary identification are rejected.

2026-01-13

Added — QR Delay on POST /deposit. Set delayDepixInHours (integer, 1–720) to hold a deposit until a later time instead of processing it immediately. When set, GET /deposit-status returns delayUntil (ISO 8601) indicating when the deposit will be processed, and the deposit reports the delayed status until then.

2026-08-07#

2026-06-12#

2026-06-11#

2026-05-26#

2026-05-01#