Accrue Savings Authentication

generated: '2026-09-06'
method: searched
source: https://docs.byaccrue.com/api/ (Introduction > Authentication) and https://docs.byaccrue.com/getting-started-api
docs: https://docs.byaccrue.com/api/
summary: Bearer token (the Client Secret) plus a Client-ID header, sent on every request. There is no
  OAuth, no OIDC, and no mTLS.
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  in: header
  parameter: Authorization
  description: 'Every API call carries `Authorization: Bearer <Client Secret>`. The Client Secret is issued
    per Client (merchant) and is a backend-only credential — the docs state it must never appear in client-side
    code and should be rotated periodically. An invalid, missing, or expired token returns HTTP 401.'
  source: https://docs.byaccrue.com/api/
- name: clientId
  type: apiKey
  in: header
  parameter: Client-ID
  description: A Client-ID header accompanies the bearer token and identifies the merchant tenant. It
    is declared as a required header parameter on all 82 operations in the OpenAPI.
  source: openapi/accrue-savings-merchant-api-openapi.yaml
oauth2: false
openid_connect: false
mutual_tls: false
errors:
  '401': Unauthorized — token invalid, missing, or expired
  '403': ForbiddenException — observed live on an unauthenticated GET /api/v1/payments
gaps:
- The OpenAPI declares NO components.securitySchemes and no top-level or per-operation `security` block.
  Authentication is expressed only as two required header parameters (Authorization, Client-ID) on each
  operation, plus prose in the Introduction section. A generator or agent reading the spec alone cannot
  tell that these are credentials, which is why derive-authentication.py produced nothing for this provider
  and this file was written from the docs instead.
- No credential-rotation endpoint, no token expiry semantics, and no scope model are published.
webhook_auth:
  mechanism: signature verification
  note: The getting-started guide instructs integrators to verify webhook signatures with a constant-time
    comparison, but the signing header name and algorithm are not published in the public docs or the
    OpenAPI.
  source: https://docs.byaccrue.com/getting-started-api