Authentication

BankConnect authenticates client applications with mutual TLS (mTLS) client certificates — there is no API key or OAuth flow for the business endpoints.

How it works

Every business request (sending a payment, polling for messages) must present a client certificate that was issued to you during enrollment. The certificate's Subject Alternative Name contains two URNs the API reads to identify your application:

• urn:bankconnect:environment:<environment> — must match the API's configured environment (e.g. Development, Production)
• urn:bankconnect:id:<clientApplicationId> — your client application's identifier

On each request the API looks up a matching, non-revoked client-application record by certificate thumbprint and serial number. If nothing matches, the request is rejected before it reaches any controller.

Two certificates, two purposes

Certificate	Used for
mTLS client certificate	Presented on the TLS connection itself, for every request.
Document-signing certificate	Used to XML-sign payment documents (see Sending Payments). Verified against the certificates on file for your client application — it is not the same key pair as the mTLS certificate.

Connecting through a proxy

If your integration environment sits directly against the API's IIS/Kestrel binding, the mTLS handshake happens at the TLS layer as usual. If a firewall, load balancer, or reverse proxy terminates TLS in front of the API, ask the bank which HostingType mode is configured (firewall, loadbalancer, nginx, or nginx_liberty) — in that case the proxy forwards your client certificate to the API via a header instead of a raw TLS handshake, and your side of the integration is unaffected either way: you still present the mTLS client certificate on your outbound connection.

Enrollment token (one-time, setup only)

Before you have a working mTLS certificate, the one-time certificate signing request upload (POST /csr) is authorized differently: with a short-lived, bank-issued enrollment bearer token sent as Authorization: Bearer <token>. This token is only valid for that single enrollment step — it does not authenticate any other endpoint.