Exchange credentials for JWT token

curl --request POST \
  --url https://platform.spritz.finance/v1/integrator/tokens \
  --header 'Content-Type: application/json' \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "userApiKey": "ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm",
  "expiresIn": 3600
}
'

import requests

url = "https://platform.spritz.finance/v1/integrator/tokens"

payload = {
    "userApiKey": "ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm",
    "expiresIn": 3600
}
headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    userApiKey: 'ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm',
    expiresIn: 3600
  })
};

fetch('https://platform.spritz.finance/v1/integrator/tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'userApiKey' => 'ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm',
    'expiresIn' => 3600
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/tokens"

	payload := strings.NewReader("{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/tokens")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "spr_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "userId": "6a749a054c3b8fc5da595d1d",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "expiresAt": "2026-08-06T15:28:21.833Z"
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

POST

integrator

tokens

Exchange credentials for JWT token

curl --request POST \
  --url https://platform.spritz.finance/v1/integrator/tokens \
  --header 'Content-Type: application/json' \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "userApiKey": "ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm",
  "expiresIn": 3600
}
'

import requests

url = "https://platform.spritz.finance/v1/integrator/tokens"

payload = {
    "userApiKey": "ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm",
    "expiresIn": 3600
}
headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    userApiKey: 'ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm',
    expiresIn: 3600
  })
};

fetch('https://platform.spritz.finance/v1/integrator/tokens', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/tokens",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'userApiKey' => 'ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm',
    'expiresIn' => 3600
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/tokens"

	payload := strings.NewReader("{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/tokens")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/tokens")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"userApiKey\": \"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm\",\n  \"expiresIn\": 3600\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "spr_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "userId": "6a749a054c3b8fc5da595d1d",
  "tokenType": "Bearer",
  "expiresIn": 3600,
  "expiresAt": "2026-08-06T15:28:21.833Z"
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

Authorizations

X-Signature

string

header

required

HMAC signature authentication for backend integrators.

Required Headers:

X-Integrator-Key: Integrator API key (format: int_...)
X-Signature: HMAC signature (format: sha256={hex})
X-Timestamp: Unix timestamp in milliseconds
Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

timestamp: Unix timestamp in milliseconds
METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
path: Request path (e.g., /v1/transactions)
bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key

string

header

required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp

string

header

required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Body

userApiKey

string

required

User API key for token exchange

Minimum string length: 1

Example:

"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm"

expiresIn

number

default:3600

Token lifetime in seconds (default: 3600, max: 3600)

Required range: 1 <= x <= 3600

Example:

3600

Response

Response for status 200

accessToken

string

required

JWT access token with spr_ prefix

Example:

"spr_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

userId

string

required

The internal ID of the authorized user

Example:

"6a749a054c3b8fc5da595d1d"

tokenType

enum<string>

required

Token type (always 'Bearer')

Available options:

Bearer

expiresIn

number

required

Token lifetime in seconds

Example:

3600

expiresAt

string<date-time>

required

ISO 8601 timestamp when token expires

Example:

"2026-08-06T15:28:21.833Z"

Auto-Ramp Accounts

Auto-Ramp Addresses

Off-Ramp Quotes

Off-Ramps

On-Ramps

Bank Accounts

Funding Sources

Deposits

Bills

Cards

Debit Cards

Integrator Connect

Integrator

Users

Compliance

Terms

API Keys

Device Authorization

Wallet Kit

Sandbox

Exchange credentials for JWT token

Authorizations

Body

Response