Security

This page covers how Feezback secures API access: authentication, encryption, network-level access controls, and rate limiting. For webhook-specific security (IP whitelisting, custom headers, mTLS, OAuth on your own endpoint), see Webhooks - Async Updates.

Authentication — two separate checkpoints

Feezback's flow involves two distinct JWTs, signed differently, that are easy to conflate. Keep them separate:

1. The JWT you sign yourself, sent to Link Generation Service (LGS) to create a consent link or token (/link, /token, /link-batch, /public-link). You sign this with your own key, registered with Feezback during onboarding. Supported signing algorithms: RS512, ES256, or EdDSA — your choice.

2. The bearer token used on every actual data-API call (AIS, PIS, Mandate, etc.). This token is generated and signed by Feezback itself — always with EdDSA — not by you. LGS hands it back to you in response to step 1, and you use it as-is on subsequent API calls; you never sign this one.

Feezback validates, at minimum, the sub and exp claims on every incoming token — expired tokens are rejected outright, so make sure your token lifetimes and refresh timing account for this.

---

Encryption (JWE)

Every token Feezback returns to you from Link Generation Service is encrypted before being sent back — key encryption via RSA-OAEP-256, content encryption via A256CBC-HS512.

---

Inbound IP access restriction

Feezback restricts which source IPs are allowed to call the API using your credentials —

---

Rate limiting

The API enforces a rate limit per source IP. Requests beyond the limit return HTTP 429.

If you expect high-volume traffic during normal operation (e.g. bulk onboarding, batch jobs), talk to your integration contact ahead of go-live so your expected volume can be accounted for. If you hit unexpected 429s, reach out to integration-support with the timestamps and endpoint rather than guessing at the threshold.

Common questions