# Authentication

The Omni CLO API uses issuer-scoped server-side API tokens. It does not use OAuth or Bearer authentication.

## Authorization header

Send this header with every Percents API request:

```http
Authorization: token <token-id>:<token-secret>
```

The token ID starts with `tok_` and the secret starts with `api_`.

```http
Authorization: token tok_11111111-1111-4111-8111-111111111111:api_example_secret
```

`Bearer`, Basic authentication, query-string credentials, and a token without the `token ` scheme are invalid.

## Credential handling

- Store the token in a secrets manager.
- Use it only from issuer-controlled server infrastructure.
- Never include it in browser or mobile code.
- Do not log the `Authorization` header.
- Use different credentials for sandbox and production.
- Contact Percents immediately if a credential is exposed.


## Network access

Percents may enforce a source-IP allowlist before token validation. Provide stable public egress IP addresses or CIDR ranges for every environment that will call the API. Coordinate changes before moving production traffic to new egress addresses.

## Authorization gates

Authentication identifies the issuer. Percents separately enables:

- access to the Omni merchant and offer APIs;
- file uploads; and
- specific file content formats such as `plaid-txn-stream`.


A correctly authenticated request can therefore receive `401` or `403` when the issuer is not enabled for the requested capability.

The token inherits issuer scope, so clients do not send an issuer identifier or scope override.
Offer, merchant, and transaction-file operations are resolved for the authenticated issuer. Contact
Percents if a credential returns unexpected data; do not attempt to override scope in a query
parameter or payload.

## Webhook Signing

Outgoing webhooks use a different `sign_` signing token and the `X-Percents-Signature` header. Never use the API token to validate a webhook. See [Webhook Signing](/omni-api/overview/webhooks/signatures).