Authentication

Every API call requires an access token (JWT Bearer). Authentication uses centralized identity (Keycloak): one account, one login, and roles decide what each user sees.

Authentication header

Every authenticated request

curl -s https://sandbox.api.ddpay.tech/api/v1/bank/wallet/... \
  -H "Authorization: Bearer <access_token>"

If the token is missing or invalid, the API returns HTTP 401 Unauthorized. If the user doesn't have the required role for the resource, it returns HTTP 403 Forbidden.

Token lifecycle

Obtain the token when starting the session (session endpoint).
Use it in every call until expiry (by default, 1 hour).
When it expires, log in again and get a new token.