Security model

‚Äč

The Finqware API is protected by a number of keys and tokens.

It is important to follow the best practice around where it's safe to store/use them. You can make an API call from a web application using the client_id, but use an access_token only from your server-side code. Currently, a generally accepted opinion among security experts is that you cannot safely store secrets in a client application.

Token/key

Client

Description

client_id

yes

An identifier for a tenant app

client_secret

no

A secret generated for each tenant app

client_app_key

yes

Used to initate a user session

temp_token

yes

A temporary token that can be exchanged for an access_token

access_token

no

A permanent token authorizing access to user data

credentials_id

no

Points to user data (eg: a bank account, an insurance)