The first step to working with Cross River APIs is to submit a request for Sandbox access.

Make sure you fill in all the relevant fields. The more accurate the information you give us at this stage, the faster you'll be onboarded into our systems.

Include:

Once we allowlist your static IP, we send you 2 encrypted emails with your credentials. One email with your client_id and one email with your client_secret. Your relationship manager will give you your partner_id.

The request and response models for Cross River products are available in our Swagger .



OAuth 2.0 is a popular protocol for authorization. This controls entry to our system and ensures that only authorized entities can access our APIs and other protected resources. The information you enter into our authentication system is confidential and can never be accessed from any other Cross River applications.

Accessing Cross River APIs

Our system authenticates machine clients and authorizes them to talk to our APIs.

Authenticating your identity

The Cross River Integration Team provides you with a client_id and a client_secret that you use when requesting an access token. You can use a web-based tool, like Postman, to send API requests.

Detailed instructions for using Postman to create an access token.

Go into the Explorer, click the arrow down next your login, and click Copy Access Token.

The access token is copied to your clipboard and ready for use in the Sandbox.

COS uses OpenID Connect and OAuth 2.0 for authentication and authorization. Before you can use the API, you must obtain an access token using the client_id and client_secret provided to you. Once a token has been obtained, it must be passed in the Authorization header of each request to the API.

To request a token send a POST to our auth server containing the client ID and client secret provided.

When you've successfully authenticated, an access_token will be returned to you. This access token allows you to send information securely as a JSON object for use in our APIs. Add this token to the header of your API calls.

Make sure to protect your token. Don’t log it. Anyone who steals your token can impersonate your client for the lifetime of the token.

In the header of each API request, the access token obtained should be included as follows:

API Request Header

Authorization: Bearer [your token here]

In the top of the swagger screen, paste the token from the clipboard into the token field and click Explore. The token is now activated.

The access token should be stored and used until it expires. The token response you receive specifies the expiration time in seconds.

Do not request a new token for every API request.

It is recommended you use the current token until you receive a 401 unauthorized error, at which point you would request a new token.



To start working with bank rails, make sure you have:

We also recommend that you register for the relevant webhook events.

Next, pick the bank rail you want to use

You can now make your first payment.

We have a full sandbox to explore. The sandbox is a completely isolated environment, so feel free to experiment. When you're ready to move to production, let us know and we will get you production credentials to access the live environment.

To see a list of upcoming releases, monitor current API status, view incident reports, or get notified of scheduled maintenance, visit our status page and subscribe to alerts.