Skip to content
Getting Started

Getting Started

Learn how to access, authenticate with, and use the Fintech Core API.

Base URL

The test environment lives at:

https://api.demo.fintechcore.app

Most services follow the same shape: a service path prefix, then the versioned resource path.

{base URL}/{service}/v{version}/{resource}

example: https://api.demo.fintechcore.app/auth/v1/challenge

The prefix is not always the display name. The exact server URL for each service is shown in its section of the API Reference.

Requests and responses are JSON.

Getting Access

There’s no public sign-up or self-service API key generation. Access is granted directly by our team:

  1. Send your email or phone number to dashdevs.com/contact-us.
  2. We add it to the whitelist for the test environment.
  3. Use that identifier on your first request to start a challenge (see Authentication below) to get your access token.

Authentication

Start a challenge with your whitelisted email or phone number (phone numbers in E.164 format, e.g. +380951234567):

POST /auth/v1/challenge HTTP/1.1
Content-Type: application/json

{"identifier": "you@example.com"}

The response contains a short-lived challenge token, and a one-time verification code is sent to that email or phone. In the test environment the code may also be returned directly in the response as code.

Exchange the code for an access token. Send the challenge token in the Authorization header and the code as secret:

POST /auth/v1/token HTTP/1.1
Authorization: Bearer <challenge_token>
Content-Type: application/json

{"grant_type": "challenge_secret", "secret": "111111"}

The response contains access_token, access_token_expires_in, and token_type (plus id_token when requested via scope: "openid").

The grant types you’ll use most often are below. The full list is in the grant_type field of the Auth reference.

Grant type Use it to…
challenge_secret Exchange the one-time code from /auth/v1/challenge for your first access token.
refresh_token Exchange a previously issued refresh_token for a new access token.
stepup Re-verify a session to authorize a higher-risk action.

Send the access token as Authorization: Bearer <access_token> on every request.

Errors & Status Codes

Errors use the RFC 9457 Problem Details shape (application/problem+json): type, title, status, detail, instance. Validation failures on some endpoints also include a field-level errors map. Check the endpoint’s response schema in the API Reference.

Status Meaning
400 Validation failed or the request body couldn’t be parsed.
401 Missing or invalid access token.
403 Authenticated, but not allowed to do this.
404 Resource doesn’t exist.
409 Conflicts with the current state.
422 Request was well-formed but rejected by business rules (e.g. a transfer or order).
500 Unexpected server error.
503 Service temporarily unavailable (e.g. code delivery); retry later.

Next Steps

Once you have an access token, head to the API Reference to browse endpoints for each service and try requests live.

API Reference