Authentication

Authenticate as a partner to receive a Bearer token for use in all subsequent Netevia Banking API requests.

Authentication

Partners access Netevia Banking API services using their provided username, password, and Partner ID. Authenticating against the token endpoint returns a short-lived Bearer token that must be included in every subsequent API call. Tokens expire after 10 minutes and can be refreshed without re-entering credentials.

Endpoint

POST /api/auth/v2

When to use

Use this endpoint at the start of every integration session or whenever an existing token has expired. All protected Netevia API endpoints require a valid Bearer token, so authentication must succeed before any other API call can be made. Partners should also implement token refresh logic to avoid interruptions during long-running operations.

Request Body

Field	Type	Required	Description
NickName	string	Yes	Partner username provided during onboarding
Password	string	Yes	Partner password provided during onboarding
TokenDevice	string	Yes	Device type making the request (e.g., `"Server"`)
NameDevice	string	Yes	Identifier for the calling application or environment

{
  "NickName": "YourPartnerUsername",
  "Password": "YourPartnerPassword",
  "TokenDevice": "Server",
  "NameDevice": "Netevia"
}

Response

200 OK

Field	Type	Description
token	string	Bearer token to include in the `Authorization` header of all subsequent requests
expiration	string (ISO 8601)	UTC timestamp indicating when the token expires (10 minutes from issuance)
userId	integer	Internal identifier for the authenticated partner user

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expiration": "2024-10-04T10:52:46.4946013Z",
  "userId": 1
}

Using the Token

Include the token in the Authorization header of every subsequent API request:

Authorization: Bearer {token}

The Partner ID (partnerId) is also required in many API calls to identify which resources and permissions apply to your integration. It is provided during onboarding alongside your credentials.

Token Refresh

When a token is about to expire or has expired, refresh it without re-authenticating from scratch:

POST /api/auth/refresh

Error Codes

Code	When it happens
400	Request body is malformed or a required field is missing
401	Credentials are invalid or the token has expired
403	Partner account does not have permission to access the requested resource
500	Internal server error

Common Mistakes

Omitting TokenDevice or NameDevice — both fields are required and the request will fail without them
Not refreshing the token before it expires — tokens have a 10-minute lifetime; build refresh logic into your integration
Using Basic authentication instead of Bearer — all Netevia API endpoints require Authorization: Bearer {token}
Hardcoding credentials in client-side code — store NickName and Password securely in environment variables or a secrets manager
Forgetting to include the partnerId in downstream API calls — many endpoints require it to resolve partner-specific resources and permissions

Related Endpoints

POST /api/auth/refresh — Refresh an existing Bearer token without re-authenticating
GET /api/partner/{partnerId}/resources — Retrieve resources available to your partner account

Example

curl -X POST https://api.banking.netevia.dev/api/auth/v2 \
  -H "Content-Type: application/json" \
  -d '{
    "NickName": "YourPartnerUsername",
    "Password": "YourPartnerPassword",
    "TokenDevice": "Server",
    "NameDevice": "Netevia"
  }'

Getting access: If you have not yet received partner credentials, visit https://netevia.com/request-api-access/ or contact [email protected].