Qentaz Authentication

generated: '2026-07-20'
method: searched
source: https://docs.qentaz.com/documentation/autenticacion/token
docs: https://docs.qentaz.com/documentation/autenticacion/token
summary:
  types: [apiKey, http]
  model: two-step-bearer
  api_key_in: [header]
  notes: >-
    Two-step bearer authentication. A static, long-lived authentication key
    (auth_key, issued per integration) is sent as an HTTP Bearer credential to
    GET /token, which returns a short-lived access_token (expires_in seconds,
    e.g. 3600). That access_token is then sent on every subsequent request in
    the custom x-auth-token header. No OAuth2/OIDC discovery is published; the
    auth_key is provisioned out of band. Administered ("child") accounts are
    selected with an optional child-id header.
schemes:
- name: authKeyBearer
  type: http
  scheme: bearer
  used_on: GET /token
  header: Authorization
  format: 'Bearer {auth_key}'
  description: >-
    Static per-integration authentication key exchanged for a temporary access
    token. Presented as an HTTP Bearer credential to the token endpoint.
- name: accessToken
  type: apiKey
  in: header
  name_param: x-auth-token
  used_on: all protected endpoints (e.g. POST /transaction, GET /v1/merchant/transaction/)
  description: >-
    Short-lived access token returned by GET /token, sent on every protected
    request. Value is the access_token from the token response.
- name: childId
  type: apiKey
  in: header
  name_param: child-id
  required: false
  description: >-
    Optional business/account selector used with administered (managed / child)
    accounts to scope a request to a sub-account.
- name: webhookSignature
  type: apiKey
  in: header
  name_param: Authorization
  format: 'Bearer base64(client_id:client_secret_key)'
  direction: inbound-to-your-endpoint
  description: >-
    Trazo signs outbound webhook deliveries with a Bearer credential built from
    base64(client_id:client_secret_key) so your endpoint can verify authenticity.
token_endpoint:
  method: GET
  path: /token
  response:
    access_token: string
    expires_in: integer (seconds)