1. Authentication

Fondo uses OAuth 2.0 Client Credentials. Credentials are provided by Fondo as part of partner onboarding. Exchange your client_id and client_secret for a bearer token — it grants access to all clients under your partner.

client_id not to be confused with the client-concept

curl -i -X POST \
  https://api.sandbox.fondo.se/v2/partner/auth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d grant_type=client_credentials \
  -d client_id=string \
  -d client_secret=string \
  -d 'scope=`account:read, account:write`
' \
  -d state=VGhpcyBpcyBteSBzdGF0ZS4gVGhlcmUgYXJlIG1hbnkgbGlrZSBpdCwgYnV0IHRoaXMgaXMgb25lIG1pbmUu

Include the token in all subsequent requests:

Authorization: Bearer {access_token}

Tokens are short-lived — reuse during validity and renew on expiry.

The partner API uses a server-to-server trust model. A valid bearer token grants access to all accounts under your client — there is no per-request end-user identity verification from Fondo's side.

This means:

• You are responsible for authenticating end-users before making API calls on their behalf.
• Operations include financial transactions such as fund orders and withdrawals.
• The executorRef field on orders and withdrawals must contain the end-user's verified SSN. Fondo validates it against the account owner's SSN, but cannot verify how you obtained it.

The end-user's identity should be verified before any operation that uses executorRef — for example via BankID or equivalent strong authentication.

Next: Create a client