Authentication and authority

Authentication depends on the API family and environment. The institution identifier selects context. Permission and ownership checks decide which records and actions the caller can use.

Core staff API

The source-generated core contract declares HTTP Basic and the nucleus-platform-tenantid header. Staff identity is supplied by the institution’s administrator. Use the narrowest permitted role and office scope.

POST /authentication can return base64EncodedAuthenticationKey. That value encodes the username and password and must receive the same protection as those credentials. Its presence establishes no session expiry or token revocation behavior. Check the selected deployment’s SSO and MFA arrangement separately.

Customer and corporate channels

The /self API family uses customer identity and links to permitted customer relationships. Inspect the exact operation’s association and ownership rules before exposing it in an application. Staff credentials belong in trusted staff integrations. Corporate signing combinations and account mandates are distinct from staff roles.

See the digital banking guide for discovered self-service routes and the current gaps.

Partner APIs and Transfer adapters

The local open-banking profile uses tenant-local partner credentials, customer consent and read scopes. A partner grant cannot supply missing customer consent. Transfer adapter callbacks have separate authentication, signing and replay contracts. The legacy inbound transfer callback checks X-Inbound-Token; the local NPS profile uses its own signed and encrypted message contract.

An API key issued for one family must be used only with that family’s documented header, audience and scope. See partner integration.

Console and Mothership

Console is the institution’s relationship portal for licences, team, API keys, invoices and support. Banking roles are set in the Nucleus web app and in each add-on. Mothership is the platform control plane. A platform role supplies no customer-account authority.

This documentation site serves guides and contract files. The retired browser-only portal gate has been removed. Confidential operational material needs a separately enforced access service before publication.

Recover access safely

For a denied call, retain status, operation and correlation identity. Ask the institution’s access owner to check actor, environment, tenant, office, product and approval scope. Keep authentication material out of screenshots, receipts, URLs and application logs.