The Omni CLO API uses issuer-scoped server-side API tokens. It does not use OAuth or Bearer authentication.
Send this header with every Percents API request:
Authorization: token <token-id>:<token-secret>The token ID starts with tok_ and the secret starts with api_.
Authorization: token tok_11111111-1111-4111-8111-111111111111:api_example_secretBearer, Basic authentication, query-string credentials, and a token without the token scheme are invalid.
- Store the token in a secrets manager.
- Use it only from issuer-controlled server infrastructure.
- Never include it in browser or mobile code.
- Do not log the
Authorizationheader. - Use different credentials for sandbox and production.
- Contact Percents immediately if a credential is exposed.
Percents may enforce a source-IP allowlist before token validation. Provide stable public egress IP addresses or CIDR ranges for every environment that will call the API. Coordinate changes before moving production traffic to new egress addresses.
Authentication identifies the issuer. Percents separately enables:
- access to the Omni merchant and offer APIs;
- file uploads; and
- specific file content formats such as
plaid-txn-stream.
A correctly authenticated request can therefore receive 401 or 403 when the issuer is not enabled for the requested capability.
Percents provisions each issuer against one channel-partner network. The token inherits that scope, so clients do not send a network name or partner identifier. Offer, merchant, and transaction-file operations are resolved for the network associated with the authenticated issuer. Contact Percents if a credential returns data for an unexpected network; do not attempt to override scope in a query parameter or payload.
Outgoing webhooks use a different sign_ signing token and the X-PERCENTS-SIGNATURE header. Never use the API token to validate a webhook. See Verify webhook signatures.