Authentication Overview

Authentication Overview

Islamic Open Finance™ provides multiple authentication methods to secure your API access.

Authentication Methods

Method	Use Case	Security Level
API Keys	Server-to-server	High
OAuth 2.0	User delegation	High
JWT Tokens	Session-based	Medium

Authorization

Authorization is handled by Cerbos, providing:

• ABAC (Attribute-Based Access Control) - Decisions based on attributes
• RBAC (Role-Based Access Control) - Decisions based on roles
• Policy-as-Code - Authorization rules defined in YAML
• Service & Embedded PDPs - Flexible deployment options

Quick Start

API Key Authentication

The simplest way to authenticate:

curl https://api.islamicopenfinance.com/api/v1/contracts \
  -H "Authorization: Bearer iof_sk_live_abc123..."

OAuth 2.0

For user-delegated access:

curl https://api.islamicopenfinance.com/oauth2/token \
  -d "grant_type=authorization_code" \
  -d "code=auth_code_here" \
  -d "client_id=your_client_id" \
  -d "client_secret=your_client_secret"

Security Best Practices

1. Never expose secrets in client-side code
2. Rotate API keys regularly
3. Use environment variables for credentials
4. Implement proper key scoping
5. Monitor API usage for anomalies

Next Steps

• API Keys - Generate and manage API keys
• OAuth 2.0 - Implement OAuth flows
• Authorization (Cerbos) - Policy-based access control
• Webhooks Security - Secure webhook endpoints