Authentication

Use an access token to authenticate every protected Bank Client API request. Framnex provides a separate username and secret for each environment.

Keep credentials secure

Store the username and secret in a server-side secret store. Do not include them in browser code, mobile applications, source control, logs, or URLs.

Use separate credentials for each environment. A token is valid only for the environment that issued it.

Request an access token

The Bank Client API base URL includes the Merchant service path:

https://<host>/api/merchant

Exchange the username and secret at POST /integration/auth/token:

The response contains the token type, access token, and lifetime in seconds:

{
  "accessToken": "<token>",
  "tokenType": "Bearer",
  "expiresIn": 3600
}

The expiresIn value is an example. Always use the value returned by the API.

Authenticate a request

Send the access token in the Authorization header:

For example:

Do not send the username or secret to protected resource endpoints.

Renew an access token

The API does not return a refresh token. Request a new access token with the same credentials before the current token expires. Use expiresIn to calculate the renewal time, and allow a small safety margin for network and clock differences.

If a protected request returns 401 Unauthorized, discard the current token, obtain a new token, and retry the request once. Do not retry authentication failures without a limit.

Troubleshooting

400 Bad Request means that the request body is invalid or a required field is missing.

401 Unauthorized from the token endpoint means that the username or secret is invalid.

401 Unauthorized from a protected endpoint means that the bearer token is missing, invalid, or expired.

Continue with the Bank Client API Quick Start for the complete first-request flow.

Keep credentials secure#

Request an access token#

Authenticate a request#

Renew an access token#

Troubleshooting#

Keep credentials secure

Request an access token

Authenticate a request

Renew an access token

Troubleshooting