Authentication and authorization

Authentication guide

The Direct Card API supports JWT and x-signature as the primary authentication mechanism. In order to make requests to our system, you will need to authenticate them. To do that, you need to include the following fields in the headers of your API requests:

• Content-Type

• X-API-Key

• Authorization

X-signature is used in Notification Endpoint. See Get notified of a transaction status changefor more details.

The description of these parameters is provided in the table below:

Parameter Name	Description	Required	Validation / Example
Content-Type	Indicates the original media type of the resource	Yes	The value must be "application/json"
X-API-Key	Your API Key	Yes	X-API-Key: 9ezEvY3UZv72ouqeLnzeL45ylrbPdZ5C6Y3e2c1H
Authorization	JSON Web Token Generated based on header, payload, and signature.	Yes	Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJhcGlLZXkiOiIzOWFhNmI5ZDhjNGZmYjFhOT QwM2I1MTQ2OWVmZDQ3ZSIsIm9yZGVySWQi OiIyMDIwMDMzMDE0MjYwMCIsImxhbmciOiJlb iIsIm1lcmNoYW50TmFtZSI6Iktva28gZUJvb2tzIiwi cGF5VHlwZSI6NSwicGF5Q2hhbm5lbCI6MzMyLC JwYXlQcm92aWRlciI6NTA2LCJpdGVtcyI6W3siY2 9kZSI6IjEiLCJuYW1lIjoiT25lIERheSIsInByaWNlIjoxM H1dLCJpYXQiOjE1ODU3MDE3MzMsImNoZWNrc 3VtIjoiZjQwZmM5ZTc0ZDY2MmRhZmY1MDc0MD NiZmM3YmEyOGUifQ.1vnmI6ayPNMHV9FNyx1
x-signature	To perform an integrity check, signature value for checksum	Yes	pOsnb4LGor0/iOPsc/7ufSiQHslKkV6/iJ6c6tEpP3k=