Overview

Fintecture API is a powerful tool that enables developers to build secure, reliable, and scalable financial applications. With it, you can easily initiate payments, access bank accounts and manage transactions. By using our API, you can streamline your financial operations, reduce costs, and improve your overall user experience.

Create an account and get direct access to all SANDBOX resources.

📘

Note

To access PRODUCTION resources, you will need to activate your account.

Environments & base URLs

Fintecture provides two fully isolated environments. Sandbox mirrors production behavior and is free to use for development and testing.

Each environment uses its own set of API keys: credentials created in the Console for sandbox will not work in production, and vice versa.

To test complete flows without a real bank account, see Testing complete payment flows in Sandbox and the Demo Bank.

Transport security

All Fintecture APIs are served exclusively over HTTPS, in both environments. Plain HTTP is never used to serve API traffic: requests made over HTTP receive a permanent redirect (301) to HTTPS, and no endpoint accepts unencrypted calls.

Our endpoints support TLS 1.2 and TLS 1.3 only. Older protocol versions (SSLv3, TLS 1.0, TLS 1.1) are rejected during the handshake, and all supported cipher suites provide forward secrecy (ECDHE key exchange). This configuration follows the highest industry security standards and actively tracks the latest recommendations of the IETF (RFC 8446), ANSSI, and Mozilla's modern TLS guidelines.

🔒

Client requirement

Your integration must use an HTTP client that supports TLS 1.2 or higher. Any reasonably up-to-date runtime (OpenSSL 1.0.1+, Java 8+, .NET 4.6+, Node.js, Python 3.4+) meets this requirement.

Authentication & request signing

Every API call is authenticated with two complementary mechanisms:

• OAuth 2.0 access tokens — obtained with your application credentials. Depending on the product you integrate, see Request a PIS access token, Request an AIS access token, or Request a Customers access token.
• HTTP request signature — sensitive requests are signed with your application's private key, guaranteeing integrity and non-repudiation. See HTTP Signature.

Your private key is generated when you create an application in the Console and is only ever held by you — Fintecture stores the public key only. Keep it secret; never embed it in client-side code.

Request & response format

The API is JSON in, JSON out: request bodies and responses use application/json encoded in UTF-8. Log the identifiers returned with each response (such as session and request IDs) — they allow our support team to trace the exact call when you report an issue.

Webhooks & outbound IPs

Fintecture notifies your backend of payment lifecycle events via webhooks. See Manage webhooks for payloads and signature verification, Configure webhooks for Console setup, and the Event Simulator to trigger test events in sandbox.

If your infrastructure restricts inbound traffic, allowlist the following Fintecture outbound IPs (webhook calls originate from these addresses):

⚠️

Webhook signature verification is your source of truth — IP allowlisting is defense in depth, not a substitute for verifying the event signature.

Getting help

If you're stuck, browse the Help Center or contact our support team with the request identifiers from your API responses — they let us trace the exact call.