Skip to main content
POST
Create a connect session

Authorizations

X-Signature
string
header
required

HMAC signature authentication for backend integrators.

Required Headers:

  • X-Integrator-Key: Integrator API key (format: int_...)
  • X-Signature: HMAC signature (format: sha256={hex})
  • X-Timestamp: Unix timestamp in milliseconds
  • Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

  • timestamp: Unix timestamp in milliseconds
  • METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
  • path: Request path (e.g., /v1/transactions)
  • bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key
string
header
required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp
string
header
required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Body

redirectUri
string
required

Callback URI that receives the authorization code.

Minimum string length: 1
state
string

Opaque integrator state returned unchanged after approval.

Minimum string length: 1

Response

Response for status 200

sessionId
string
required
authorizationUrl
string
required
expiresAt
string<date-time>
required