Brazil Central Bank Open Data Authentication Guide (2026)

Authentication overview

The Brazil Central Bank Open Data platform, managed by the Banco Central do Brasil (BCB), offers public access to a wide range of economic, financial, and statistical data. For most of its publicly available datasets, direct authentication via API keys or tokens is not required. This design choice facilitates broad access for researchers, developers, and the public to critical financial information without an explicit registration process for basic data retrieval.

The primary method for accessing data involves making direct HTTP GET requests to specific API endpoints. While the current model emphasizes open access, developers should consult the official Brazil Central Bank API reference for any updates regarding authentication requirements for new or specialized services. The architecture supports standard web protocols, ensuring compatibility with various programming languages and tools.

The BCB's commitment to data transparency aligns with its regulatory functions, providing data that supports economic analysis and policy formulation. As such, the focus remains on ease of access for public information, while ensuring data integrity and availability through robust infrastructure.

Supported authentication methods

The Brazil Central Bank Open Data API primarily operates on an unauthenticated access model for its core public datasets. This means that for endpoints providing general economic indicators, time series data, and financial statistics, developers can retrieve information using standard HTTP GET requests without needing to provide any credentials such as API keys, OAuth tokens, or username/password combinations. This approach simplifies integration and promotes widespread data utilization.

While most data is openly accessible, it is important to note that specific, more sensitive, or specialized services, particularly those related to Open Banking initiatives, may implement different authentication protocols. For instance, the broader Brazil Central Bank regulatory framework for Open Banking often mandates strong authentication mechanisms, typically based on OAuth 2.0 and mutual TLS (mTLS), to secure data exchange between financial institutions and authorized third-party providers. However, these advanced authentication methods are generally specific to regulated financial services and not applied to the public Open Data API endpoints for general information retrieval.

Developers should always refer to the specific documentation for each API endpoint they intend to use to confirm any authentication requirements. The table below summarizes the typical authentication methods relevant to the Brazil Central Bank's data offerings:

Given that the primary focus of the Brazil Central Bank Open Data API is public data, the most common interaction will be unauthenticated. For scenarios requiring OAuth 2.0 or mTLS, developers would typically need to register as a regulated entity or third-party provider, which involves a separate onboarding process governed by specific financial regulations.

Getting your credentials

For the vast majority of endpoints within the Brazil Central Bank Open Data API that provide public economic and financial data, no specific credentials (such as API keys, client IDs, or client secrets) are required. This design choice aligns with the BCB's goal of providing transparent and accessible public information without barriers to entry for data consumers.

Developers can directly access most API endpoints by constructing the appropriate URL and making an HTTP GET request. There is no registration process, account creation, or credential issuance necessary for accessing these open datasets. This simplifies the development workflow, allowing immediate data retrieval. The official API documentation provides examples of unauthenticated requests.

However, if the Brazil Central Bank introduces new services or specific data categories that require authenticated access in the future, the process for obtaining credentials would likely involve:

1. Registration: Creating an account on a designated developer portal or service, typically requiring organizational details and contact information.
2. Application for Access: Submitting an application for API access, specifying the intended use case and data requirements.
3. Credential Issuance: Receiving API keys, client IDs, and client secrets upon approval, which would then be used in conjunction with authentication protocols like OAuth 2.0.
4. Regulatory Compliance: For highly regulated data (e.g., Open Banking), additional compliance checks and certifications might be necessary.

As of the current public offering, developers should assume direct access for open data. Always consult the latest Brazil Central Bank API documentation for any updates or specific requirements related to new or restricted services.

Authenticated request example

Given that the primary access model for the Brazil Central Bank Open Data API is unauthenticated for public datasets, an 'authenticated' request example would not typically apply in the conventional sense of requiring an API key or token in the header or query parameters. Instead, the example below demonstrates a standard HTTP GET request to a public endpoint, which is the common method for interacting with this API.

This example retrieves the Selic rate (Brazil's benchmark interest rate) time series data from the API. No authentication headers or parameters are included.

Python example (using requests library)

import requests
import json

# Base URL for the Brazil Central Bank Open Data API
BASE_URL = "https://api.bcb.gov.br/olinda/servico/SGSPub/versao/v1/odata/"

# Endpoint for Selic rate (series 439)
endpoint = "ValoresSeries(SERIE='439')"

# Parameters for the request (e.g., ordering by date, selecting specific fields)
# $top=10 retrieves the last 10 entries
# $orderby=Data%20desc sorts by date in descending order
# $format=json specifies JSON output
params = {
    '$top': 10,
    '$orderby': 'Data desc',
    '$format': 'json'
}

# Construct the full URL
request_url = f"{BASE_URL}{endpoint}"

print(f"Making request to: {request_url} with params: {params}")

try:
    # Make the GET request
    response = requests.get(request_url, params=params)
    response.raise_for_status()  # Raise an exception for HTTP errors (4xx or 5xx)

    # Parse the JSON response
    data = response.json()

    # Print the retrieved data
    if data and 'value' in data and len(data['value']) > 0:
        print("Successfully retrieved Selic rate data:")
        for entry in data['value']:
            print(f"  Date: {entry['Data']} - Value: {entry['Valor']}")
    else:
        print("No data found or unexpected response format.")

except requests.exceptions.RequestException as e:
    print(f"An error occurred during the request: {e}")
    if response is not None:
        print(f"Response status code: {response.status_code}")
        print(f"Response body: {response.text}")
except json.JSONDecodeError:
    print("Failed to decode JSON response.")
    print(f"Raw response: {response.text}")

This example demonstrates how to interact with an unauthenticated public endpoint. If the BCB were to introduce an endpoint requiring, for instance, an OAuth 2.0 bearer token, the request would be modified to include an Authorization header:

# Example of an authenticated request structure (hypothetical for BCB public data)
# This is NOT required for current public BCB Open Data endpoints.

# access_token = "YOUR_OAUTH_BEARER_TOKEN"
# headers = {
#     "Authorization": f"Bearer {access_token}"
# }
# response = requests.get(authenticated_url, headers=headers, params=params)

Always refer to the Brazil Central Bank's specific API endpoint documentation for precise requirements, especially if dealing with new or restricted services.

Security best practices

While the Brazil Central Bank Open Data API primarily offers unauthenticated access to public data, adhering to general security best practices for API consumption is still crucial. These practices help ensure the integrity of your applications, protect against potential vulnerabilities, and maintain efficient data retrieval.

1. Validate and Sanitize Inputs

Always validate and sanitize any user-provided input before incorporating it into API requests. This prevents injection attacks (e.g., SQL injection if constructing database queries based on API data, or command injection if passing parameters to a shell). For example, if allowing users to specify date ranges or series IDs, ensure these inputs conform to expected formats and do not contain malicious characters.

2. Handle API Responses Securely

Process API responses carefully. Always assume that external data, even from trusted sources, might contain unexpected formats or data. Implement robust error handling and data parsing to prevent application crashes or misinterpretations. Ensure that any sensitive information (if such were ever to be provided by future authenticated endpoints) is not logged or exposed inadvertently.

3. Use HTTPS for All Communications

The Brazil Central Bank API endpoints are served over HTTPS. Always ensure your application communicates with the API using HTTPS to encrypt data in transit. This protects against eavesdropping and man-in-the-middle attacks, even for public data, by verifying the server's identity and ensuring data integrity. This is a fundamental web security practice, as detailed by the Mozilla Developer Network on HTTPS.

4. Implement Robust Error Handling and Logging

Proper error handling allows your application to gracefully manage issues like network failures, API rate limits, or unexpected data formats. Logging API requests and responses (excluding sensitive data) can aid in debugging and monitoring, providing insights into usage patterns and potential issues. Be mindful of log retention policies and ensure logs are stored securely.

5. Manage Dependencies and Libraries

If using third-party libraries or SDKs (like the unofficial Python or R SDKs for BCB data), keep them updated to their latest stable versions. This ensures you benefit from security patches and bug fixes. Regularly review your project's dependencies for known vulnerabilities, using tools like dependency scanners.

6. Monitor API Usage

Even for public APIs, monitoring your application's usage patterns can help identify unexpected behavior, such as excessive requests that might indicate a compromised system or a bug in your code. While the BCB API might not have strict rate limits for public data, being a good API citizen helps maintain service availability for all users.

7. Protect Your Application Environment

Ensure the environment where your application runs is secure. This includes keeping operating systems and software up to date, configuring firewalls, and restricting access to servers. If you are building an application that processes or stores the data, ensure your data storage solutions comply with relevant data protection regulations, such as Brazil's LGPD (Lei Geral de Proteção de Dados), especially if combining BCB data with other datasets that might contain personal information.

By following these best practices, developers can build reliable and secure applications that effectively leverage the Brazil Central Bank Open Data API.