Skip to main content
Version: 1.0.0

Paynovus CIP Partner API

The CIP Partner API exposes a JWT-authenticated surface for trusted partners to manage B2B tenants they own, onboard cardholders under those tenants, operate individual accounts they onboard directly, create and operate cards under any of those accounts, and query fees / delivery options.

All endpoints are mounted under /api/partner and require an ES512 Bearer JWT whose iss matches the partner's registered URL and whose sub equals the partner's _id.

Authentication​

  1. Generate a P-521 (secp521r1) ES512 keypair and provide the public key to Paynovus — it is stored on the Partner record.

  2. Sign a JWT with the partner's private key. The token must contain:

    \{
      "iss": "https://your-registered-url.com",
      "sub": "<partnerObjectId&gt;",
      "exp": <unix-seconds, +1 minute&gt;,
      "iat": <unix-seconds&gt;
    \}

  3. Send the token on every request:

    Authorization: Bearer &lt;jwt&gt;

Partners are pre-trusted: a successful JWT verification pass grants full access to every resource owned by the calling partner. No additional role or permission checks are required from the caller.

All endpoints automatically scope their results to the calling partner — if you pass an :id that does not belong to your partner, the endpoint returns 404 Not Found with no further detail, regardless of whether the resource exists in another partner's scope.

Authentication​

Bearer JWT signed with ES512. The iss claim must match the partner's registered URL and sub must equal the partner's _id.

Security Scheme Type:

http

HTTP Authorization Scheme:

bearer

Bearer format:

JWT

Contact

Paynovus Development Team: office@paynovus.com