Authentication
POST - https://dominio.com.br/api/auth/
The Authentication endpoint is a critical entry point to the ENV Bank API, enabling users to securely access the platform's services. This endpoint is designed to authenticate and authorize API requests, ensuring a secure communication channel between your application and the Env Bank system. To authenticate the API successfully, users must include both the unique API Key and API Secret in the request parameters.
🚧 Heads up!
The issued token will have a lifetime of 60 minutes (3600 seconds). The partner must pay attention to the expires_in (in seconds) property to implement its cache and token renewal strategy. It is extremely important that the token is used throughout its lifetime, and that another one is issued only after the one that has already been generated has expired.
Avoid generating a new token before the current one expires to avoid overloading the system and maintain efficiency. If too many authentication requests are made before the expiration time, you may receive a temporary block of a 5 minutes with the message "Too Many Attempts."
🔐 Credentials:
The URL and credentials will be sent in the checking account registration email.
Replace (https://www.domain.com.br) with the URL sent along with the credentials via email.
url: https://www.domain.com.br
key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
➡️ Practical Tips
Security: Never expose your API key and API secret in public code or repositories. Use environment variables to store this sensitive information.
Authentication Token: Store the authentication token in a secure location and monitor its expiration time to renew the token as needed, avoiding service interruptions.
Logs: Implement appropriate logs to monitor authentication attempts and handle potential failures.
Body Params
key string required
API Key :
secret string required
API Secret:
Credenciais enviada via email
Exemplo:
curl --request POST \
--url https://dominio.com.br/api/auth/ \
--header 'accept: application/json' \
--header 'content-type: application/json' \
--data '
{
"key": "CLIENT_KEY",
"secret": "CLIENT_SECRET"
}
'
Resposta Positiva: RESPOSTA 200 JSON
{"access_token":"eyJ0eXAiOiJkV1QiLCJhbGciOiJIUzI1kLJ9.eyJpc3MiOiJodHRwczovL2FwaS5lbnZncm91cC5jb20uYnIvYXBpIiwic3ViIjoiMSIsImlhdCI6MTc1NTE4MDk3NiwiZXhwIjoxNzU1MTgyNzc2fQ.z30ERW2lO6aSlg67BzpgnqNHft1bFI9-9vAExLzjy1Y","expires_in":1800}
Token: cor
Resposta ERRO:
RESPOSTA 401 Unauthorized
{"error_code":"AC001","reason":"Credenciais inválidas"}
RESPOSTA 403 Forbidden
{"error_code":"AC002","reason":"Acesso negado pelo IP"}
RESPOSTA 400
{"error_code":"AC003","reason":"O header Accept deve ser application\/json"}
