Bitstrips has implemented a security framework for its developer ecosystem that utilizes two distinct authentication schemes, according to data indexed by APIs.io.
The platform secures its programmatic interfaces through a combination of OAuth 2.0 and HTTP bearer authentication, as defined in its current OpenAPI documentation.
OAuth 2.0 Authorization Protocols
The primary security mechanism, identified as BitmojiDirectOAuth2, relies on the standard OAuth 2.0 authorization code flow. To enhance security during the handshake process, the implementation mandates the use of Proof Key for Code Exchange (PKCE) with S256 hashing. Developers initiating this flow must register their applications within the Snap Kit Developer portal to gain access to an organization and app ID.
The authorization process begins at the dedicated connection portal, while the exchange and refreshing of tokens are handled through the Snap token endpoint. While specific OAuth scopes are not published in the developer documentation, the granted authorization provides access to core features including avatar data, sticker packs, and search capabilities. The company has officially deprecated the "Bitmoji For Identity" product line.
Token Management and Bearer Authentication
Once authorization is established, the system employs HTTP bearer authentication for ongoing requests directed at the Bitmoji API. Developers must include the access token in the header of their API requests using the format: Authorization: Bearer <token>.
The lifecycle of these tokens is strictly managed to maintain security posture:
- Access tokens are valid for one hour.
- Refresh tokens remain valid for 90 days.
This security profile, which was generated on July 18, 2026, serves as the standard for developers building applications that interface with Bitmoji services. All security artifacts associated with this configuration are accessible via the APIs.io catalog and available to AI agents through the Model Context Protocol (MCP).
