Documentation
IntroCreateBalanceHooksErrors

Authentication

The API authenticates with X-Client-Id and X-API-Key. Sensitive operations (creating transactions and withdrawals) also require an operation token.

Required Headers (Base)

Headers
X-Client-Id: e1c98954cc404cbcb2868af9b40c7a33
X-API-Key: your-secret-api-key
Content-Type: application/json
Accept: application/json

Operation Token (Required)

To create transactions and request withdrawals you must generate an additional operation token. This token adds an extra layer of security.

Required Flow

1

Generate an operation token with your credentials (X-Client-Id and X-API-Key)

2

Send the token in the X-Operation-Token header on create transaction and withdrawal calls

Token Generation Endpoint

POST/api/v1/operation-auth/token

Alias available: POST /api/Transaction/auth/token

Request Body (Optional)

Body
{
  "scopes": ["transaction:create", "cashout:create"],
  "expiresInSeconds": 300
}
  • • expiresInSeconds: minimum 30, maximum 3600, default 300
  • • scopes: if omitted, uses transaction:create and cashout:create

Response 200

Response
{
  "tokenType": "Bearer",
  "headerName": "X-Operation-Token",
  "expiresInSeconds": 300,
  "scope": ["transaction:create", "cashout:create"],
  "token": "<jwt>"
}

cURL Example

cURL
curl -X POST "https://baanko.app/api/v1/operation-auth/token" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-Client-Id: <CLIENT_ID>" \
  -H "X-API-Key: <API_KEY>" \
  -d '{"scopes": ["transaction:create", "cashout:create"], "expiresInSeconds": 300}'

Required Additional Header

Header
X-Operation-Token: <generated_token>

Required on the create transaction endpoint (POST /api/v1/transactions/create) and the withdrawal request endpoint (POST /api/Withdraw/request).

Invalid Token Error

401 Unauthorized
{
  "title": "Token de operacao invalido.",
  "detail": "Token invalido ou expirado.",
  "header": "X-Operation-Token"
}

How to Get Credentials

To use the Baanko API you need a pair of credentials: a Client ID and an API Key.

Step by Step

1

Sign in to the dashboard at https://baanko.app/login-company

2

Open the API credentials page (Credenciais de API)

3

Click Regenerate credential (Regenerar credencial) and, if your account uses 2FA, enter the 6-digit code

4

Copy the Client ID and the API Key (Secret) shown on the page

5

Store your API Key somewhere safe. Regenerating replaces both the Client ID and the API Key, and the old ones stop working

Important

The API Key is secret and must be stored securely. Never share it or expose it in client-side code.

Authenticated Request Example

cURL
curl -X GET "https://baanko.app/api/v1/transactions" \
  -H "Accept: application/json" \
  -H "X-Client-Id: e1c98954cc404cbcb2868af9b40c7a33" \
  -H "X-API-Key: your-secret-api-key"