Authentication

The MIDAPI v2 endpoints are authenticated with a consumer JWT Token sent in the header Authorization: Bearer <token>. The Token is issued from the two concepts presented in MIDAPI v2: the customer platform issues Tokens for its consumers, and each operational call is made on behalf of a consumer.

Identification headers

Header	Description
platform-id	Identifies the customer platform. Required only when issuing the consumer Token (POST /consumer/token).
platform-api-key	API Key for the customer platform. Required only when issuing the consumer Token (POST /consumer/token).
consumer-id	Identifies the channel/consumer. Required in operational endpoints (/storage and /v2/daf/*).

Operational endpoint requirements

All DAF endpoints require:

• OAuth2 authentication: header Authorization: Bearer <token>, obtained via POST /consumer/token (JWT signed with RS256, see below).

• Header consumer-id: consumer identifier. Required and non-empty.

• Header operation-id: business operation/session identifier. Required in POST /v2/daf/validate and in the status query GET /v2/daf/{transactionId}.

MIDAPI v2 does not use authentication by x-api-key. The scheme is OAuth2 Bearer + consumer-id (and operation-id when starting validation and when querying status).

Get the consumer Token

Before invoking any operational endpoint, the consumer must obtain a JWT Token and send it in the header Authorization: Bearer <token>. The Token is issued by Facephi and includes the consumer-id and the scopes corresponding to the services enabled for that consumer.

Endpoint

POST /consumer/token

Headers

Name	Type	Required	Description
platform-id	string	Yes	Identification of the customer platform.
platform-api-key	string	Yes	API Key of the customer platform.

Request body

Content-Type: application/json

Parameters

Parameter	Type	Required	Description
consumerId	string	Yes	Identifier of the consumer (channel or vertical) for which the Token is requested.

Request example

{
  "consumerId": "<consumerId>"
}

Responses

200 Success

Response parameters

Parameter	Type	Description
consumerId	string	Consumer for which the Token was issued.
token	string	JWT Token to send in the header Authorization: Bearer <token>.
expiresAt	string	Expiration date and time of the Token in ISO 8601 format ISO 8601.

Response example

{
  "consumerId": "<consumerId>",
  "token": "<jwt>",
  "expiresAt": "2026-06-26T13:00:00.000Z"
}

The Token has a validity of 1 hour from its issuance (the exact expiration instant is returned in the field expiresAt). Once expired, it is enough to request a new one using the same endpoint. On each request, the signature, issuer, the consumer-id, expiration, and scopes of the Token are validated.