RynoPay Partner API
Integrate your application with RynoPay using secure machine-to-machine authentication based on RFC 7523 (JWT Bearer Assertion).
How it works
Your Server RynoPay
| |
| 1. Sign a JWT with your |
| private key |
| |
| 2. POST /auth/partner/v1/token |
| (JWT assertion) |
| ---------------------------------> |
| | 3. Validate signature
| | using your public key
| |
| 4. Receive access token |
| <--------------------------------- |
| |
| 5. Call API with access token |
| ---------------------------------> |
| |
- Your server signs a short-lived JWT assertion using your private key.
- You send it to the RynoPay token endpoint.
- RynoPay validates the signature using your registered public key.
- RynoPay returns a platform access token (valid for 1 hour).
- You use that access token for all API calls.
No client secrets are ever transmitted over the network.
Integration steps
| Step | What you do | Where |
|---|---|---|
| 1 | Register and get approved | Partner Portal |
| 2 | Generate an ECDSA key pair | Your server |
| 3 | Upload your public key | Partner Portal |
| 4 | Build a JWT assertion | Your server |
| 5 | Exchange for an access token | API call |
| 6 | Call the RynoPay API | API call |
Server-to-server only
This authentication flow is designed for server-to-server communication. Never use it from a browser or mobile app -- your private key must remain on your server.