Authentication

Use OAuth 2.0 Client Credentials to obtain an access token for every API call. Tokens are issued per app and per environment (Sandbox vs Production), and carry the product scopes you request.

Prerequisites

• Create an App in the Developer Portal (start with Sandbox).
• Subscribe the app to every product you intend to call. In Sandbox you can subscribe yourself; in Production the subscription needs approval. Subscribing to an Open Banking product for the first time prompts you to configure your OB App.
• Find your Client ID and Client Secret under App Settings → Credentials.
• Know the scope for each product you're calling (e.g., e_statement). Explore Our Products

Token endpoints

Sandbox

POST https://test.api.neotek.sa/oauth2security/oauth2/token

Production

POST https://api.neotek.sa/oauth2security/oauth2/token

(Production is the same path, without test.)

Content-Type

Defaults to application/x-www-form-urlencoded

Request

Method: POST

Headers: Content-Type: application/x-www-form-urlencoded

From fields:

• grant_type=client_credentials

• client_id="YOUR_CLIENT_ID"

• client_secret="YOUR_CLIENT_SECRET"

• scope="PRODUCT_NAME"

  Scope Example: e_statement or fast_onboarding or iban_verification. Explore Our Products

  You can request more than one scope in a single call by separating them with spaces — for example e_statement single_api.

Example (curl)

1) Get an access token (Sandbox)

curl -X POST https://test.api.neotek.sa/oauth2security/oauth2/token \  -H "Content-Type: application/x-www-form-urlencoded" \  -d "grant_type=client_credentials" \  -d "client_id=<CLIENT_ID>" \  -d "client_secret=<CLIENT_SECRET>" \  -d "scope=e_statement"

Example response

{  "access_token": "eyJhbGciOi...<snip>",  "token_type": "Bearer",  "expires_in": 3600,  "scope": "e_statement"}

2) Call a Sandbox API with the token

curl https://test.api.neotek.sa/<product-base>/v1/<endpoint> \  -H "Authorization: Bearer <ACCESS_TOKEN>"

Using the token

Include the token in every request header to a product endpoint:

Authorization: Bearer <ACCESS_TOKEN>

Token lifetime: Respect the expires_in value; cache and reuse until expiry.

Refresh: Client Credentials flow does not return refresh tokens—request a new token when expired.

Common errors