Authentication

Copy

• Copy for LLM

  Copy page as Markdown for LLMs
• View as Markdown

  Open this page as Markdown
• Open in ChatGPT

  Get insights from ChatGPT
• Open in Claude

  Get insights from Claude
• Connect to Cursor

  Install MCP server on Cursor
• Connect to VS Code

  Install MCP server on VS Code

The Banking API uses OpenID Connect with the OAuth 2.0 standard for authenticating access tokens. Your access token authorizes you to use the Banking API.

This is the endpoint used for production environments:

https://id.aritma.io/connect/token

Scopes

Grant Types

The OpenID Connect and OAuth 2.0 specifications define so-called grant types (often also called flows - or protocol flows), which specify how a client can interact with the token service.

The Banking API supports client credentials grants which means you need a ClientID and Client Secret which can be exchanged for an access token that grants access to the API.

Example Request

curl -i -X POST https://id.dev.aritma.io/connect/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d grant_type=client_credentials \
    -d client_id=$CLIENT_ID \
    -d client_secret=$CLIENT_SECRET \
    -d scope=api

Postman

In the Postman app, complete the following:

1. Set the verb to POST.
2. Enter https://id.dev.aritma.io/connect/token as the request URL.
3. Select the Body tab.
4. Select the x-www-form-urlencoded option.
5. In the KEY field, enter grant_type.
   • In the VALUE field, enter client_credentials.
6. In the KEY field, enter client_id.
   • In the VALUE field, enter your client id.
7. In the KEY field, enter client_secret.
   • In the VALUE field, enter your client secret.
8. In the KEY field, enter scope.
   • In the VALUE field, enter api.
9. Select Send.

Response:

{
    "access_token": "\<token>",
    "expires_in": 3600,
    "token_type": "Bearer",
    "scope": "api"
}

Access Token

The token response contains the JWT access token, the number of seconds the token is valid, included scopes and the token type.

When you make calls to a REST API, include the access token in the Authorization header with the designation as Bearer. Reuse the access token until it expires.

Authorization: Bearer \<token>