Skip to main content

​
Authentication

Partner API uses a two-step handshake:
  1. You sign a short assertion JWT with your Ed25519 private key
  2. Auth returns a short-lived access token (EdDSA, IMBA keys)
  3. You call Partner API with Authorization: Bearer <access_token>
HS256 client / Wallet tokens are not accepted.

​
Assertion → access token

​
Assertion claims

​
Access token

Never send partner_id in the body or URL.

​
Scopes

Matching: exact scope, or area wildcard like cards:* (covers cards:issue).
*:* is not a valid grant. Credentials without explicit money scopes get read-only defaults only (balance:read, deposit_address:read, document:read, reconciliation:read).

​
Key rotation

  1. Generate a new Ed25519 keypair and register a new kid
  2. Start signing assertions with the new key
  3. Ask IMBA to revoke the old kid (revoked_at)
Keep the private key only on your servers. Card encryption uses a separate X25519 key — see Card encryption.

​
Tenant access state

Even with a valid JWT, a blocked or inactive tenant contract receives 403. Contact support if access was revoked unexpectedly.