Skip to main content
Version: 1.0.0

Paynovus CIP Partner API

The CIP Partner API exposes a JWT-authenticated surface for trusted partners to manage individuals they onboard, create and operate cards under those individuals, and query fees / delivery options.

All endpoints are mounted under /api/partner and require an ES512 Bearer JWT whose iss matches the partner's registered URL and whose sub equals the partner's _id.

Authentication​

  1. Generate a P-521 (secp521r1) ES512 keypair and provide the public key to Paynovus — it is stored on the Partner record.

  2. Sign a JWT with the partner's private key. The token must contain:

    \{
      "iss": "https://your-registered-url.com",
      "sub": "<partnerObjectId&gt;",
      "exp": <unix-seconds, +1 minute&gt;,
      "iat": <unix-seconds&gt;
    \}

  3. Send the token on every request:

    Authorization: Bearer &lt;jwt&gt;

Partners are pre-trusted: a successful partnerAuth middleware pass grants full access to every resource owned by req.auth.partnerId. No additional role/permission checks are enforced.

Card-level endpoints additionally verify that the card (cardKey) belongs to the calling partner via assertPartnerCardOwnership.

Authentication​

Bearer JWT signed with ES512. The iss claim must match the partner's registered URL and sub must equal the partner's _id.

Security Scheme Type:

http

HTTP Authorization Scheme:

bearer

Bearer format:

JWT

Contact

Paynovus Development Team: office@paynovus.com