Authentication

Use an access token to authenticate every protected BaaS API request. Framnex provides a separate username and secret key for each environment.

Keep credentials secure

Store the username and secret key in a server-side secret store. Do not include them in browser code, mobile applications, source control, logs, or URLs.

Use separate credentials for each environment. A token is valid only for the environment that issued it.

Request an access token

The BaaS API base URL includes the Child Brand Integration service path:

https://<host>/api/child-brand-integration

Exchange the username and secret key at POST /auth/token:

The response contains the token type, access token, and lifetime in seconds:

{
  "accessToken": "<token>",
  "tokenType": "Bearer",
  "expiresIn": 3600
}

The expiresIn value is an example. Always use the value returned by the API.

Authenticate a request

Send the access token in the Authorization header:

For example:

Do not send the username or secret key to protected resource endpoints.

Renew an access token

The API does not return a refresh token. Request a new access token with the same credentials before the current token expires. Use expiresIn to calculate the renewal time, and allow a small safety margin for network and clock differences.

If a protected request returns 401 Unauthorized, discard the current token, obtain a new token, and retry the request once. Do not retry authentication failures without a limit.

Troubleshooting

400 Bad Request means that the request body is invalid or a required field is missing.

401 Unauthorized from the token endpoint means that the username or secret key is invalid.

401 Unauthorized from a protected endpoint means that the bearer token is missing, invalid, or expired.

Continue with the BaaS API Quick Start for the complete client onboarding and account opening flow.

Keep credentials secure#

Request an access token#

Authenticate a request#

Renew an access token#

Troubleshooting#

Keep credentials secure

Request an access token

Authenticate a request

Renew an access token

Troubleshooting