Authentication and signatures
Portal sign-in uses the two values Fintwin issues: company code and authorization key.
Sign in
There is no self-service signup. Fintwin issues the sandbox company code and authorization key after engagement. A production key cannot be called from the portal because the portal is configured with sandbox hosts only.
When the key is issued for the portal, the portal egress IP must be on that key's allowlist. A key bound only to the partner server IP cannot be used through the portal.
Headers for a real integration
- Authorization: the API key.
- Content-Type: application/json.
- Signature: integrity of the body on APIs that require it. The signing key is issued with onboarding and is not typed into the sign-in form.
- Timestamp: request time on linking and payment APIs.
Debit mandate
The business payload is AES-256-CBC encrypted into the data field. The 32-byte key and 16-byte vector are issued separately and are not stored on the portal. API pages show the payload before encryption. Sandbox Try asks for the key and vector, encrypts in the browser, then prints the { data } body that was sent.