For developers
Start with bank rails

Authenticate

11min

OAuth 2.0 is a popular protocol for authorization. This controls entry to our system and ensures that only authorized entities can access our APIs and other protected resources. The information you enter into our authentication system is confidential and can never be accessed from any other Cross River applications.

Accessing Cross River APIs

Our system authenticates machine clients and authorizes them to talk to our APIs.

Authenticating your identity

The Cross River Integration Team provides you with a client_id and a client_secret that you use when requesting an access token. You can use a web-based tool, like Postman, to send API requests.

IMPORTANT Auth0 support has ended. Please note the updated endpoints below:

Sandbox:

Auth0 support in the sandbox environment has ended.

Production:

HTTPS request components

HTTP component

Attribute

Description

Endpoint

POST /connect/token

Endpoint for retrieving an access token

Header

content-type

application/x-www-form- urlencoded

Body

grant_type

This field will always have a value of client_credentials

Body

client_id

The unique identifier for a client

Body

client_secret

An encrypted string of characters used to sign and validate ID tokens.

Important: Secrets aren't recoverable by CR. If you lose a secret, a new one must be generated. Do not commit your secrets into source control.

Body

audience

A way for the user to validate if a particular access token is meant for them.

Get an access token

Sample call for an access token in cURL

Sample access token in cURL


Sample call for an access token in Postman

Document image


Request tokens using Explorer

Go into the Explorer, click the arrow down next your login, and click Copy Access Token.

The access token is copied to your clipboard and ready for use in the Sandbox.

Document image


Request tokens using the API

COS uses OpenID Connect and OAuth 2.0 for authentication and authorization. Before you can use the API, you must obtain an access token using the client_id and client_secret provided to you. Once a token has been obtained, it must be passed in the Authorization header of each request to the API.

To request a token send a POST to our auth server containing the client ID and client secret provided.

Sample response from cURL request


Successful authentication and access token returned

When you've successfully authenticated, an access_token will be returned to you. This access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

IMPORTANT Make sure to protect your token. Don’t log it. Anyone who steals your token can impersonate your client for the lifetime of the token.

Sample response from cURL request


Present tokens

In the request header

In the header of each API request, the access token obtained should be included as follows:

API Request Header

Authorization: Bearer [your token here]

Sample call for wire payment in cURL


In Swagger

In the top of the swagger screen, paste the token from the clipboard into the token field and click Explore. The token is now activated.

Document image

Document image


The access token should be stored and used until it expires. The token response you receive specifies the expiration time in seconds.

Do not request a new token for every API request.

It is recommended you use the current token until you receive a 401 unauthorized error, at which point you would request a new token.



🤔
Have a question?
Our super-smart AI, knowledgeable support team and an awesome community will get you an answer in a flash.
To ask a question or participate in discussions, you'll need to authenticate first.



Updated 15 Oct 2024
Doc contributor
Did this page help you?