Authentication

Partner API uses a short-lived Bearer JWT minted by Transfero Checkout.

1. Exchange credentials for a token

Call POST /api/v1/partner-api/auth/token with:

Credentials are validated with Azure AD client credentials. Your partner account must be enabled for the Partner API channel (PartnerApiEnabled). Missing headers, invalid secrets, a disabled partner, or a partner without Partner API access return 401.

Successful response:

{
  "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "tokenType": "Bearer",
  "expiresIn": 3600
}

2. Call other endpoints with Bearer

Send the token on every other Partner API request:

Authorization: Bearer {accessToken}

Do not send x-partner-id / x-partner-secret on business endpoints.

Verify credentials

Call GET /api/v1/partner-api/auth/me with the Bearer token. A successful response confirms the token resolves to your partner and that Partner API is enabled.

Notes

• Treat x-partner-secret as a secret. Use it only on POST /auth/token. Rotate it through your Transfero contact when needed.
• Access tokens expire (expiresIn seconds). Mint a new token when needed; there is no refresh token.
• Base path for all operations: /api/v1/partner-api.