For the complete documentation index, see llms.txt. This page is also available as Markdown.

Authentication

The MIDAPI v2 endpoints are authenticated with a consumer JWT Token sent in the header Authorization: Bearer <token>. The Token is issued from the two concepts presented in MIDAPI v2: the customer platform issues Tokens for its consumers, and each operational call is made on behalf of a consumer.

Identification headers

Header
Description

platform-id

Identifies the customer platform. Required only when issuing the consumer Token (POST /consumer/token).

platform-api-key

API Key for the customer platform. Required only when issuing the consumer Token (POST /consumer/token).

consumer-id

Identifies the channel/consumer. Required in operational endpoints (/storage and /v2/daf/*).

Operational endpoint requirements

All DAF endpoints require:

  • OAuth2 authentication: header Authorization: Bearer <token>, obtained via POST /consumer/token (JWT signed with RS256, see below).

  • Header consumer-id: consumer identifier. Required and non-empty.

  • Header operation-id: business operation/session identifier. Required in POST /v2/daf/validate and in the status query GET /v2/daf/{transactionId}.

MIDAPI v2 does not use authentication by x-api-key. The scheme is OAuth2 Bearer + consumer-id (and operation-id when starting validation and when querying status).

Get the consumer Token

Before invoking any operational endpoint, the consumer must obtain a JWT Token and send it in the header Authorization: Bearer <token>. The Token is issued by Facephi and includes the consumer-id and the scopes corresponding to the services enabled for that consumer.

Endpoint

POST /consumer/token

Headers

Name
Type
Required
Description

platform-id

string

Yes

Identification of the customer platform.

platform-api-key

string

Yes

API Key of the customer platform.

Request body

Content-Type: application/json

Parameters

Parameter
Type
Required
Description

consumerId

string

Yes

Identifier of the consumer (channel or vertical) for which the Token is requested.

Request example

Responses

200 Success

Response parameters

Parameter
Type
Description

consumerId

string

Consumer for which the Token was issued.

token

string

JWT Token to send in the header Authorization: Bearer <token>.

expiresAt

string

Expiration date and time of the Token in ISO 8601 format ISO 8601.

Response example

The Token has a validity of 1 hour from its issuance (the exact expiration instant is returned in the field expiresAt). Once expired, it is enough to request a new one using the same endpoint. On each request, the signature, issuer, the consumer-id, expiration, and scopes of the Token are validated.

Last updated