Authentication
How API keys and consent tokens work in OnePath Connect.
OnePath Connect uses two complementary authentication mechanisms: a partner API key for your server-to-server calls, and a user consent JWT for each individual user interaction.
Partner API Key
Your API key identifies your organization. It must be kept secret — never expose it in client-side code.
X-API-Key: onepath_production_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxSandbox keys look like onepath_sandbox_.... Production keys look like onepath_production_.... All requests to /partner/v1/ require this header.
API keys are scoped to your organization. If you suspect a key has been compromised, rotate it immediately from the Partner Portal.
User Consent Token
Every user interaction also requires a short-lived JWT that proves the user has consented to this specific data access. Your server generates this token using your private key.
// Node.js example
import { SignJWT } from "jose";
const consentToken = await new SignJWT({
sub: "your-internal-user-id",
partner: "your-partner-id",
scope: "full-health",
iat: Math.floor(Date.now() / 1000),
exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour
})
.setProtectedHeader({ alg: "RS256" })
.sign(yourPrivateKey);Pass it as a second header:
X-Consent-Assertion: <consent-jwt>Sandbox Credentials
In the sandbox environment, we provide pre-signed consent tokens so you can test immediately without managing keys.
See Sandbox Environment for test credentials.