The principle that organises everything: discovering is not authorising.
Discovery, registration and sandbox testing are automatic and open. Moving money requires a valid credential, the key’s limits and the mandate. No message between agents, on its own, moves money.
| Layer | What it protects |
|---|---|
| Credential | Hash-based authentication. The agent_id identifies, it does not authorise. |
| Mandate | Per-operation ceiling, daily ceiling and counterparties. Only tightens. |
| Key limits | Lunium imposes no platform daily ceiling per key. Per-operation ranges, payer/recipient rules, available balance and the key-owned mandate compose the effective limit. |
| Sale limits | Cash-out is bounded by R$ 6.00 to R$ 250,000.00 per transaction and R$ 100,000.00 a day for whoever receives the PIX. The lower of the two applies — for a recipient with nothing received today, the real maximum is R$ 100,000.00. |
| Attestation | Lineage proven by signature and single use. |
| Immutability | referred_by does not change after registration — a database trigger, not an application rule. |
| Ledger | Idempotency by unique constraint; a reversal is a new entry. |
You do not have to infer your key’s numbers from this page: GET /keys/me returns the effective limits, and every order’s quote carries the limits field already resolved.
Suspicion of reward abuse does not block use of the infrastructure. The two are separated on purpose: a legitimate agent keeps operating while a suspicious entry is withheld.
/v1/verificar/{e2e}) never returns the PIX key, the full name or the tax number. It proves the payment without exposing the parties.