Authentication and authorization

OAuth 2.0 is a popular protocol for authorization. This controls entry to our system and ensures that only authorized entities can access our APIs and other protected resources. The information you enter into our authentication system is confidential and can never be accessed from any other Cross River applications.

Accessing Cross River APIs

Our system authenticates machine clients and authorizes them to talk to our APIs.

Authenticating your identity

The Cross River Integration Team provides you with a client_id  and a client_secret that you use when requesting an access token. You can use a web-based tool, like Postman, to send API requests.

HTTPS request components

Ways to acquire an access token

Sample call for an access token in cURL

curl --location --request POST 'https://idptest.crbcos.com/connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=[your id here]' \
--data-urlencode 'client_secret=[your secret here]' \
--data-urlencode 'audience=https://api.crbcos.com/'

Sample call for an access token in Postman

Detailed instructions for using Postman to create an access token.

Requesting Tokens Using Explorer

Go into the Explorer, click the arrow down next your login, and click Copy Access Token.

The access token is copied to your clipboard and ready for use in the Test APIs.

Successful authentication and access token returned

When you've successfully authenticated, an access_token will be returned to you. This access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

Sample response from cURL request

1
2
3
4
5
{
    "access_token": "xxxxx",
    "expires_in": 86400,
    "token_type": "Bearer"
}

Presenting Tokens

Presenting Tokens in the Request Header

In the header of each API request, the access token obtained should be included as follows:

Authorization: Bearer [your token here]

Sample call for wire payment in cURL

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
curl --location --request POST 'https://sandbox.crbcos.com/Wires/v1/payments' \
--header 'Authorization: Bearer your token here' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-raw '{
  "accountNumber": "2255685659",
  "businessFunctionCode": "CTR",
  "receiverRoutingNumber": "021000021",
  "beneficiaryFi": {
    "idCode": "F",
    "identifier": "021000021",
    "name": "JP Morgan Chase"
  },
  "beneficiary": {
    "idCode": "D",
    "identifier": "123456789",
    "name": "Peter Griffin"
  },
  "beneficiaryReference": "XYZ123",
  "amount": 10000,
  "purpose": "payment"
}'

Presenting Tokens in Swagger

In the top of the swagger screen, paste the token from the clipboard into the token field and click Explore. The token is now activated.