Bitstrips has updated its API security architecture to mandate OAuth 2.0 with Proof Key for Code Exchange (PKCE) for all Bitmoji integrations.
According to documentation via APIs.io, the company now enforces these security standards to protect avatar data, sticker packs, and search functionality.
The updated security profile, generated as of July 18, 2026, requires developers to implement the authorization code flow with PKCE (S256). This protocol replaces older, less secure methods by requiring a cryptographically signed challenge during the initial authorization request.
Integration requires developers to register both an organization and an application through the Snap Kit Developer portal. Once authorized, API requests must include an OAuth 2.0 access token passed as an HTTP bearer token in the request header.
Access tokens issued under this scheme remain valid for one hour, while refresh tokens are set to expire after 90 days. The system exposes a specific revocation endpoint, /revoke, to allow for the immediate invalidation of tokens.
The API restricts access to Bitmoji avatar data, sticker packs, and search tools. While the developer documentation outlines these specific access grants, it does not currently publish a public list of named OAuth scopes.
Snap has officially deprecated the "Bitmoji For Identity" product. Developers transitioning from older systems or looking to build new integrations must now use the Bitmoji Direct authorization path. This path initiates at the official connection portal and utilizes the Snap token endpoint for all token exchanges and refreshes.
| Feature | Requirement |
|---|---|
| Authorization Flow | OAuth 2.0 (Authorization Code) |
| PKCE Method | S256 |
| Access Token Expiry | 1 Hour |
| Refresh Token Expiry | 90 Days |
| Authentication Header | Authorization: Bearer [token] |
Does the API require an API key for every request?
Calls directed to the Bitmoji API do not require an X-API-Key if they are authenticated via the standard OAuth 2.0 bearer token process. Access to specific paid tools within the broader API catalog may require a paid plan and an associated key.
Where can developers register their applications?
All applications must be registered through the Snap Kit Developer portal to obtain the necessary credentials for the authorization code flow. The process requires both an organization account and an application-specific configuration.
Keep reading