Token Io Authentication

generated: '2026-09-17'
method: searched
source: openapi/token-io-account-on-file-api-openapi.yml, openapi/token-io-accounts-api-openapi.yml, openapi/token-io-authentication-keys-api-openapi.yml, openapi/token-io-banks-v1-api-openapi.yml, openapi/token-io-banks-v2-api-openapi.yml, openapi/token-io-pay-by-link-api-openapi.yml, openapi/token-io-payments-v2-api-openapi.yml, openapi/token-io-payouts-api-openapi.yml, openapi/token-io-refunds-api-openapi.yml, openapi/token-io-reports-api-openapi.yml, openapi/token-io-requests-for-payments-v1-or-ais-api-openapi.yml, openapi/token-io-settlement-accounts-api-openapi.yml ...
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
schemes:
- name: Bearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: '**For Production and Sandbox environments.**<br />When using curl samples the authorization header is given as -H `''Authorization: Bearer + JWT''`<br/>Please substitute your Bearer key here.<br/>For example:<br/> -H `''Authorization: Bearer eyJhbGciOiJFZERTQSIsImtpZCI6IjF4N2RmNHZ1RlVIWVFDYTciLCJtaWQiOiJtOlhUalhlMkFQZTRvdmVaalE4cHoyNGdEbUZEcTo1ekt0WEVBcSIsImhvc3QiOiJsb2NhbGhvc3Q6ODAwMCIsIm1ldGhvZCI6I'
  sources:
  - openapi/token-io-account-on-file-api-openapi.yml
  - openapi/token-io-accounts-api-openapi.yml
  - openapi/token-io-authentication-keys-api-openapi.yml
  - openapi/token-io-banks-v1-api-openapi.yml
  - openapi/token-io-banks-v2-api-openapi.yml
  - openapi/token-io-pay-by-link-api-openapi.yml
  - openapi/token-io-payments-v2-api-openapi.yml
  - openapi/token-io-payouts-api-openapi.yml
  - openapi/token-io-refunds-api-openapi.yml
  - openapi/token-io-reports-api-openapi.yml
  - openapi/token-io-requests-for-payments-v1-or-ais-api-openapi.yml
  - openapi/token-io-settlement-accounts-api-openapi.yml
  - openapi/token-io-sub-tpps-api-openapi.yml
  - openapi/token-io-tokens-api-openapi.yml
  - openapi/token-io-transfers-for-payments-v1-api-openapi.yml
  - openapi/token-io-variable-recurring-payments-api-openapi.yml
  - openapi/token-io-verification-api-openapi.yml
  - openapi/token-io-webhooks-api-openapi.yml
- name: BasicAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: '**For Sandbox environment only.**<br />When using curl samples the authorization header is given as -H `''Authorization: YOUR_API_KEY_HERE''`<br/>Please substitute your Basic key here.<br/>For example:<br/> -H `''Authorization: Basic bS0zanhoS3pqRjRSWFQ1dHZLTlhMQU14cm80d0E1LTV6S3RYRUFxOmU1MWZjZDQ0LTM5MGQtNDYxZi04YjA0LTEyMjcxOTg4YWYwNg==''`'
  sources:
  - openapi/token-io-account-on-file-api-openapi.yml
  - openapi/token-io-accounts-api-openapi.yml
  - openapi/token-io-authentication-keys-api-openapi.yml
  - openapi/token-io-banks-v1-api-openapi.yml
  - openapi/token-io-banks-v2-api-openapi.yml
  - openapi/token-io-pay-by-link-api-openapi.yml
  - openapi/token-io-payments-v2-api-openapi.yml
  - openapi/token-io-payouts-api-openapi.yml
  - openapi/token-io-refunds-api-openapi.yml
  - openapi/token-io-reports-api-openapi.yml
  - openapi/token-io-requests-for-payments-v1-or-ais-api-openapi.yml
  - openapi/token-io-settlement-accounts-api-openapi.yml
  - openapi/token-io-sub-tpps-api-openapi.yml
  - openapi/token-io-tokens-api-openapi.yml
  - openapi/token-io-transfers-for-payments-v1-api-openapi.yml
  - openapi/token-io-variable-recurring-payments-api-openapi.yml
  - openapi/token-io-verification-api-openapi.yml
  - openapi/token-io-webhooks-api-openapi.yml
docs: https://docs.token.io/products/tpp/integration-considerations/authentication-models
searched:
  generated: '2026-09-17'
  detail: 'Upgraded from the derived securityScheme list by reading Token.io''s own authentication pages. The material facts the spec alone does not carry:'
  facts:
  - 'There is NO token endpoint and no OAuth flow on Token.io''s own interface. The caller MINTS its own credential: a detached JWT signed with a key enrolled against the member id, covering the request method, path and body. Token.io recommends an `exp` under 10 minutes from the request.'
  - HTTP Basic (the "BasicAuth" apiKey scheme in the spec) is accepted in the SANDBOX ONLY. The spec's own description says so; production accepts the JWT bearer only.
  - Keys are managed as first-class resources — POST/GET/DELETE /members/{memberId}/keys — and a key may carry an expiry. Key rotation is an API operation, not a support ticket.
  - 'A second, regulatory credential sits alongside the JWT: an eIDAS qualified certificate (QWAC / QSEAL), registered and verified through /eidas/register, /eidas/status and /eidas/verifications. Requests to banks are signed with it so the bank can check validity.'
  - OAuth 2.0 does appear in the wider flow, but at the layer below — the payer authorises at their own bank and Token.io brokers that redirect. It is not how a TPP authenticates to Token.io.
  scopes: None. No oauth2 securityScheme exists in any harvested spec and no scope/permission reference is published, so no scopes/ artifact is claimed for this provider.
docs_pages:
  auth_overview: https://docs.token.io/products/tpp/integration-considerations/authentication-models
  signing_guide: https://docs.token.io/products/tpp/integration-considerations/authentication-keys-api-signing
  certificates: https://docs.token.io/products/tpp/integration-considerations/managing-certificates
  api_basics: https://docs.token.io/products/tpp/integration-considerations/api-basics