Skip to main content

Authentication

banca.me uses two types of API keys for different purposes:

Backend Authentication (Private Key)​

The Private Key (also known as Secret Key or API token) is used for backend API authentication. Every endpoint in this API reference requires it, except opening the evaluation report from its link. It should be kept secure. Never expose this key in client-side code or public repositories. Make sure you keep them safe! 👮

Security

The Private Key gives access to your partner's data and doesn't expire, so treat it as a secret. Never share it or commit it to version control.

The API expects every backend request to be authenticated with the Private Key through the Authorization header:

Authorization: Bearer YOUR_PRIVATE_KEY

The Private Key is a token issued by banca.me for your partner. Your partner has a single valid Private Key per environment: banca.me checks every request against the key registered for your partner, so any other token is rejected, including the session token of the banca.me partners portal.

HTTP Status CodeWhen
401The Authorization header is missing, or the token is malformed or not signed by banca.me
400The token is signed by banca.me but is not your partner's Private Key
404The partner of the token doesn't exist
403Your partner is inactive

Frontend Authentication (Public Key)​

The Public Key is used for frontend widget initialization. This key has limited permissions and is safe to use in client-side code. It's used to initialize the Banca.me widget and validate widget tokens.

Usage

The Public Key is safe to use in client-side code and is required for widget initialization.

Example of using the Public Key in widget initialization:

const widget = BancameWidget.create({
  publicKey: "YOUR_PUBLIC_KEY",
  widgetToken: "WIDGET_TOKEN",
  // ... other configuration
});

Key Management​

  • Keep your Private Key secure and only use it in backend services
  • Use the Public Key for frontend widget initialization
  • Both keys are required for a widget integration
  • Keys are environment-specific (development, automation, production)
  • Contact support to obtain your API keys
Key Storage

Your API keys will be shared with you through a 1Password link. Make sure to store them securely. The Private Key doesn't expire: if it is exposed, contact us at soporte@banca.me.