Authenticating your request

To protect sensitive business data and payment transactions, every request to the SingleView B2B API Suite must be authenticated and verified before it is processed.

The platform uses a layered security approach that combines Access Token authentication with digital request signatures. Together, these mechanisms verify the identity of the calling application, ensure request integrity, and prevent unauthorized access.

Authentication Overview

Each API request must include:

• A valid Access Token to authenticate your application.
• A digital signature to verify that the request has not been altered during transmission.

Only requests that successfully pass both authentication and signature validation are processed by the platform.

Obtain Access Token

Before calling any protected API, your application must obtain an access token from the authentication service.

The access token serves as proof that your application has been authenticated and is authorized to access the requested APIs.

Access Token Workflow

1. Submit your authentication request using the credentials provided during onboarding.
2. Receive an access token from the authentication endpoint.
3. Store the token securely.
4. Include the token in the Authorization header of every API request.
5. Refresh or regenerate the token when it expires.

Note: Access tokens are time-limited and should be managed securely. Avoid hardcoding tokens or exposing them in client-side applications.

Generate a Request Signature

In addition to the access token, every API request must include a digital signature.

The signature is generated using your organization's private key and helps verify:

• The authenticity of the sender.
• The integrity of the request payload.
• That the request has not been modified during transit.

The SingleView platform validates the signature using the corresponding public certificate configured during onboarding.

Request Validation

When a request is received, the platform performs the following validation checks:

• Verifies the access token
• Validates the digital signature
• Confirms the request originates from an authenticated client
• Verifies request integrity
• Processes the request only if all security checks are successful

If any validation fails, the request is rejected and an appropriate error response is returned.

Authentication Flow

The authentication process follows these steps:

1. Generate or retrieve a valid access token
2. Construct the API request
3. Generate a digital signature for the request
4. Include the required authentication headers
5. Send the request over the established mutual TLS (mTLS) connection
6. Receive the API response after successful authentication and validation

Security Best Practices

To help protect your integration, follow these recommended practices:

• Store credentials, private keys, and access tokens securely.
• Never expose private keys in source code or client-side applications.
• Rotate credentials and certificates according to your organization's security policies.
• Regenerate access tokens when they expire.
• Validate server certificates before establishing connections.
• Sign every request using the configured private key.
• Use HTTPS and mutual TLS (mTLS) for all API communication.