Changelog

2026-11-04: Personal access tokens

POST /connections also accepts a customer's Deriv personal access token with the scopes trade account_manage payment. Deposits and withdrawals then work the same as for an OAuth connection. See Personal access tokens.

2026-11-03: API v2 on deriapi.site

Deripay API v2 is live at https://deriapi.site/api/v2.

Breaking changes

• v1 is retired. Every request to /api/v1/... now returns 410 with the code API_VERSION_RETIRED.
• Old keys stop working. v1 keys are not accepted by v2. Create a new dpk_live_… key under API keys and send it as Authorization: Bearer.
• New Deriv OAuth client IDs only. Connections go through your own Deriv OAuth app, registered under Deriv apps with its new client ID. Legacy numeric Deriv App IDs are rejected.
• New ids and field names. Connections are con_…, transactions are txn_…, and all fields are snake_case.

New

• Markets. Kenya (M-Pesa), Tanzania and Uganda (mobile money). Read the open list from GET /markets and live rates and limits from GET /rates?country=.
• Customer actions. Deposits outside Kenya can ask the customer for an OTP, a redirect or a USSD step, reported in customer_action.
• Simple states. Every transaction has a state (pending, action_required, awaiting_code, processing, completed, failed) next to its detailed status.
• Idempotency. Required on deposits and withdrawals, with Idempotent-Replayed: true on replays.
• Signed webhooks. transaction.updated, transaction.action_required, transaction.completed and transaction.failed, signed with Deripay-Signature.
• Live events. GET /transactions/{id}/events streams status as Server-Sent Events for a server-side relay.
• Scoped keys with optional IP allowlists.
• MCP server at https://deriapi.site/mcp for AI coding agents, plus /llms.txt, /llms-full.txt and /openapi.json. See Using Deripay with AI agents.

Not offered

• Crypto deposits.