Authentication

The POST /api/auth/v2 endpoint authenticates a user and issues a secure Bearer token granting access to protected banking features and services. Submit valid credentials in the request body to receive a token that must be included in the Authorization header of all subsequent API calls. The token has a lifetime of 10 minutes and can be refreshed via the token refresh endpoint before expiry.

Endpoint

POST /api/auth/v2

Authentication

This endpoint does not require a prior Bearer token — it is the token-issuing endpoint itself. No Authorization header is needed for this request.

When to use

Call this endpoint at the start of every API session to obtain a Bearer token before making any other requests. Use it again when the current token has expired or is about to expire to avoid interruptions in service. It is also used when a new device registers with the platform and requires a device-bound token.

Query Parameters

Request Body

The request body accepts one of two schemas: a standard token request or a token request with CAPTCHA verification.

Standard token request (banking.business.auth.tokenrequest)

With CAPTCHA (banking.business.auth.captchatokenrequest)

Extends the standard token request with an additional captcha object:

{
  "nickName": "jsmith",
  "password": "P@ssw0rd!",
  "tokenDevice": "d3f1a2b4-8e67-4c91-b0d5-2f3e1a9c7b84",
  "nameDevice": "Partner Server Node 1",
  "smsCode": "847201",
  "typeOperation": "ShortMessageCode"
}

With CAPTCHA:

{
  "nickName": "jsmith",
  "password": "P@ssw0rd!",
  "tokenDevice": "d3f1a2b4-8e67-4c91-b0d5-2f3e1a9c7b84",
  "nameDevice": "Partner Server Node 1",
  "captcha": {
    "token": "03AGdBq24PBggV9RZ..."
  }
}

Response

200 OK

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6ImpzbWl0aCIsImlhdCI6MTY5MDAwMDAwMH0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "expiration": "2026-06-08T14:30:00Z",
  "userId": 100423
}

Error Codes

Common Mistakes

• Omitting tokenDevice or nameDevice — both are required fields even for server-to-server integrations; use a stable UUID and a descriptive label.
• Sending Authorization: Bearer {token} on this endpoint — this request does not require a prior token and the header is ignored.
• Reusing a token after it has expired (10-minute lifetime) instead of calling this endpoint again or using POST /api/auth/refresh.
• Not including the MFA smsCode when the account has multi-factor authentication enabled, resulting in a 401 or 403 error.
• Passing typeOperation without the corresponding smsCode or TOTP code, or vice versa.

Related Endpoints

• POST /api/auth/refresh — Refresh an existing Bearer token before it expires to maintain uninterrupted API access.

Example

curl -X POST https://api.banking.netevia.dev/api/auth/v2 \
  -H "Content-Type: application/json" \
  -d '{
    "nickName": "jsmith",
    "password": "P@ssw0rd!",
    "tokenDevice": "d3f1a2b4-8e67-4c91-b0d5-2f3e1a9c7b84",
    "nameDevice": "Partner Server Node 1"
  }'