Authentication

Use this page to choose an authentication method, obtain a bearer token, and send authenticated requests to the Verto API.

Before you authenticate

Complete these setup steps first:

1. Get your Client ID and API Key from Access Your Credentials.
2. Confirm your user role can access Verto API in the dashboard. If the menu is missing, ask an admin to grant API permissions.
3. Copy your credentials immediately after generation. Verto only shows the API key once.
4. Arrange production IP whitelisting before you send live traffic.
5. Choose your authentication method:
   • Use API key-based authentication for legacy integrations and sandbox testing.
   • Use certificate-based authentication for production and high-security environments.

Verto uses JSON Web Tokens (JWT) so you can exchange your credentials for a bearer token and send that token with subsequent API requests.

For merged sandbox services, send login requests to POST https://api-company-sandbox.vertofx.com/users/login instead of legacy api-v3-sandbox.vertofx.com/users/login or older unified auth paths. The login response returns both a bearer token and companyId; store both values because company-scoped services such as Wallet use companyId in the request path.

Merged service authentication flow

Use this flow for the merged Login, Wallet, Beneficiary, Exchange, Payment, and Onboarding services:

1. Call POST https://api-company-sandbox.vertofx.com/users/login with clientId, apiKey, and mode: "apiKey".
2. Store the returned token and companyId.
3. Send Authorization: Bearer <token> with protected API requests.
4. Use companyId in company-scoped routes, such as GET https://api-wallet-sandbox.vertofx.com/{companyId}/wallets.
5. Refresh or regenerate the token before the 60-minute expiry.

curl --request POST \
  --url https://api-company-sandbox.vertofx.com/users/login \
  --header 'accept: application/json' \
  --header 'content-type: application/json' \
  --data '{
    "clientId": "YOUR_CLIENT_ID",
    "apiKey": "YOUR_API_KEY",
    "mode": "apiKey"
  }'

Use Environments to find the current sandbox host for each merged service.

Security

VertoFX is built on a robust and secure communication protocol. VertoFX API is a set of instructions submitted with the standard HTTPS Post requests. At the server end, we use a certificate delivered by Verisign. The SSL encryption guarantees that it is our servers you are communicating with and that your data is transmitted in encrypted form.

When we receive a request, we check the level of encryption. Directly TLSv1.2 version and the next version are supported.

⚠️

Warning

Non-encrypted HTTP connections are not accepted. Do not connect to our API with unencrypted HTTP, as this will transmit your access token in plaintext over the network.

⚠️

Warning

Do not proceed with a connection when you receive a certificate validation error from VertoFX. Make sure that all parts of your application are using encryption and HTTPS, and failing only when certificate validation fails.

Choose Your Authentication Method

Recommended flow

1. Generate credentials in the Verto dashboard.
2. Authenticate through https://api-company-sandbox.vertofx.com/users/login and obtain a token.
3. Store the returned companyId for company-scoped routes.
4. Send Authorization: Bearer <token> with each protected API request.
5. Refresh or regenerate the token before the 60-minute expiry.

API Key-Based Authentication

⚠️ To be deprecated

Simple authentication using Client ID and API Key. This method is still available for existing flows and sandbox testing, but new production integrations should plan to use certificate-based authentication.

Learn more about API Key-Based Authentication →

Certificate-Based Authentication

🛡️ Recommended

Enhanced security using public key infrastructure (PKI). Each user is issued a pair of cryptographic keys: a public key and a private key.

Use this method if you need stronger request authentication, a production-ready security model, or tighter control over how credentials are used in your backend.

Learn more about Certificate-Based Authentication →

Next steps