Configuring Environments & Security
Configure Feezback environments, JWT signing, service selectors, and security rules before integration.
All Feezback flows are initiated from your backend using a signed JSON Web Token (JWT). The JWT selects the product, identifies your TPP, and carries the product-specific configuration for the user flow or API request.
Environments
Feezback provides separate domains for link/token generation and TPP APIs.
| Purpose | Integration | Production |
|---|---|---|
| Link and token generation — LGS | lgs-integ01.feezback.cloud | lgs-prod.feezback.cloud |
| TPP data and payments API | integ01-tpp.feezback.cloud | prod-tpp.feezback.cloud |
| Supported bank list | https://fb.feezback.cloud/bank-list.json | https://fb.feezback.cloud/bank-list.json |
| Live ASPSP issues | https://fb.feezback.cloud/aspsp_issues.json | https://fb.feezback.cloud/aspsp_issues.json |
Link and token endpoints
Use the LGS domain when you need to generate a link or token.
| Action | Integration URL | Production URL |
|---|---|---|
| Generate a user link | https://lgs-integ01.feezback.cloud/link | https://lgs-prod.feezback.cloud/link |
| Generate a bearer token | https://lgs-integ01.feezback.cloud/token | https://lgs-prod.feezback.cloud/token |
Use the TPP domain when you call Feezback APIs with a bearer token.
| API type | Integration base URL | Production base URL |
|---|---|---|
| TPP API | https://integ01-tpp.feezback.cloud | https://prod-tpp.feezback.cloud |
JWT signing requirements
Sign every JWT on your backend with your private key.
For production environment, you must generate your own private key and send Feezback the matching public key when submitting a request for prod env.
| Requirement | Value |
|---|---|
| Signing algorithm | RS512 |
| Issuer format | tpp/{TPP_ID} |
| Signing location | Backend only |
| Request origin | Whitelisted backend IP address |
Never sign JWTs in a browser or mobile client. Your private key must stay on your backend.
Required JWT claims
Most Feezback JWTs include these top-level claims.
Encryption flag for /link endpoints
/link endpointsEvery JWT sent to a /link endpoint must include "encrypt": true at the top level.
{
"encrypt": true,
"iss": "tpp/{TPP_ID}",
"sub": "user-123",
"srv": "fast/user",
"flow": {
"id": "default"
}
}Place encrypt at the top level, not inside flow.
Service selectors
Use the srv claim to select the Feezback product.
| Product | srv value | Used with |
|---|---|---|
| FAST Single Payment | fast/user | /link |
| Fast Seamless | seamless/tpp | /token, then TPP payment APIs |
| Direct Debit Mandate Authorization | mandate/user | /link |
| Bank Feed consent — AIS | ais/user | /link |
| Bank Feed API access — AIS | ais/tpp | /token, then TPP data APIs |
| VIEW consent | view_ais/user | /link |
| VIEW dashboard link | view/user | /link |
Security checklist
Before calling prod environment:
-
Register separate public keys for integration and production.
-
Keep private keys only on your backend.
Updated 7 days ago