Authentication

Partners must implement one of the following authentication methods so Flex can securely call their API.

Option 1: OAuth 2.0 Client Credentials

Partners host a token endpoint and provide Flex with client credentials. Flex exchanges these credentials for short-lived access tokens.

Setup

1. Partner creates a client application for Flex
2. Partner provides Flex with:
   • client_id
   • client_secret
   • Token endpoint URL
3. Flex requests tokens using the client credentials flow

Token Request

Flex calls the partner's token endpoint:

POST /oauth/token HTTP/1.1
Host: partner.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&
client_id=flex_client_id&
client_secret=flex_client_secret&
scope=read write

Token Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read write"
}

API Request with Token

Flex includes the access token in the Authorization header:

GET /biller/123/account/456 HTTP/1.1
Host: partner.example.com
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Scopes

Scope	Description
read	Query operations: Get Account, Get Balance, Get Payment
write	Mutation operations: Put Account Payment

Option 2: API Key

Partners provide Flex with a static API key and an auth header. Flex sets this header with the provided API key on every request.

Setup

1. Partner generates an API key for Flex
2. Partner provides the API key to Flex securely
3. Partner provides the auth header to Flex
4. Flex includes the key in all API requests

API Request Examples

GET /biller/123/account/456 HTTP/1.1
Host: partner.example.com
x-api-key: partner_provided_api_key_here

GET /biller/123/account/456 HTTP/1.1
Host: partner.example.com
Authorization: partner_provided_api_key_here