The Omni CLO API uses entity-owned server-side API tokens. Percents resolves the authenticated entity's issuer association before authorizing issuer operations. It does not use OAuth or Bearer authentication.
Send this header with every Percents API request:
Authorization: token <token-id>:<token-secret>The token ID starts with tok_ and the secret starts with api_.
Authorization: token tok_11111111-1111-4111-8111-111111111111:api_example_secretBearer, Basic authentication, query-string credentials, and a token without the token scheme are invalid.
- Store the token in a secrets manager.
- Use it only from issuer-controlled server infrastructure.
- Never include it in browser or mobile code.
- Do not log the
Authorizationheader. - Use different credentials for sandbox and production.
- Contact Percents immediately if a credential is exposed.
Choose one network-access path for each environment:
| Path | What you provide | Base URL |
|---|---|---|
| Source-IP allowlist | Stable public egress IP addresses or CIDR ranges | Sandbox: https://sandbox.percents.comProduction: https://prod.percents.com |
| mTLS | A CSR so Percents can issue an issuer client certificate | Sandbox: https://mtls.test.percents.comProduction: https://mtls.prod.percents.com |
Source-IP allowlisting permits calls from the approved addresses to the standard API URL. mTLS requires your HTTP client to present the issued client certificate and its corresponding private key to the dedicated mTLS URL. It does not replace API-token authentication.
Coordinate source-IP changes before moving production traffic to new egress addresses. For the mTLS issuance, validation, rotation, and revocation process, see Trusted Server Connection.
Authentication identifies the entity. An entity must be associated with an issuer to use these APIs. Percents separately enables the issuer's:
- access to the Omni merchant and offer APIs;
- file uploads; and
- specific file content formats such as
plaid-txn-stream.
A correctly authenticated request can therefore receive 401 or 403 when the issuer is not enabled for the requested capability.
Clients do not send an entity or issuer identifier to override scope. Offer, merchant, and transaction-file operations are resolved for the entity's currently authorized issuer. Contact Percents if a credential returns unexpected data; do not attempt to override scope in a query parameter or payload.
Outgoing webhooks use the recipient entity's separate sign_ signing token and the X-Percents-Signature header. Never use the API token to validate a webhook. See Webhook Signing.