{"templateId":"markdown","sharedDataIds":{},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"🚀 Getting started","llmstxt":{"hide":true}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"-getting-started","__idx":0},"children":["🚀 Getting started"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every new client will receive a dedicated ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Success Manager (CSM)"]}," who will guide them through the integration and answer any question they might have – technical or otherwise."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Upon starting the onboarding, we will create a dedicated institution entity in our system to represent your organization. We will return you a unique ID for your institution, called the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["institutionID"]},". It follows a digit hexadecimal code format such as: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["69a1e097-d243-74d2-9545-5676eb5bed7b9"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["⚠️ (!)"]}," You will need your institution’s unique ID in order to call our API."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["📡 We will also give you access to a dedicated API collection on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Postman"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"️-ip-whitelisting","__idx":1},"children":["🛡️ IP whitelisting"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For advanced security reasons, we use an IP whitelisting mechanism to access the API. We will take care of whitelisting any IP that you give us. You have several options when it comes to the IPs:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["📍 Static IPs"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["🌐 IP ranges"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["🔗 Daily IP whitelisting link:"]}," Received automatically for fast manual testing"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can request the whitelisting of further IPs or IP ranges at any time."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"-base-urls","__idx":2},"children":["🔗 Base URLs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In your API calls, you will need to set the variables baseUrl and baseUrlWebsites. These depend on the environment (UAT or Production), but are otherwise static:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["🏗️ UAT:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["BaseUrl: https://uat.api.nyala.de"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["BaseUrlWebsite: https://uat.vault.nyala.de"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["🌐 Production:"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["BaseUrl: https://api.nyala.de"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["BaseUrlWebsite: https://vault.nyala.de"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["They are also set and displayed in your Postman API collection."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication-customer-api","__idx":3},"children":["Authentication Customer API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Customer API"]}," uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HMAC (Hash-based Message Authentication Code)"]}," for security. Every request must include an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header containing a signature generated using your Secret Key."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"headers","__idx":4},"children":["Headers"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Header"},"children":["Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HMAC <API_KEY>:<SIGNATURE>"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Length"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The byte length of the request body"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"signature-calculation","__idx":5},"children":["Signature Calculation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The signature is a Base64 encoded HMAC-SHA256 hash. The \"message\" to be signed is constructed by concatenating the following strings in order:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Content Length"]},": The length of the request body (or \"0\" if empty)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HTTP Method"]},": (e.g., ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PATCH"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Normalized URL"]},": The full URL, converted to lowercase, with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["?"]}," removed."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"javascript-example","__idx":6},"children":["JavaScript Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can use this logic in your frontend or Node.js applications:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"javascript","header":{"controls":{"copy":{}}},"source":"const msg = `${contentLength || 0}${method}${url.replace(\"?\", \"\").toLowerCase()}`;\nconst hmac = CryptoJS.HmacSHA256(msg, apiSecret);\nconst signature = CryptoJS.enc.Base64.stringify(hmac);\nconst authHeader = `HMAC ${apiKey}:${signature}`;\n","lang":"javascript"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication-tokenization-api","__idx":7},"children":["Authentication Tokenization API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tokenization API"]}," uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["X-API-KEY"]}," for security. Every request must include an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-API-KEY"]}," header containing the API Key & your API Integration setup must have been completed by Nyala."]}]},"headings":[{"value":"🚀 Getting started","id":"-getting-started","depth":1},{"value":"🛡️ IP whitelisting","id":"️-ip-whitelisting","depth":2},{"value":"🔗 Base URLs","id":"-base-urls","depth":2},{"value":"Authentication Customer API","id":"authentication-customer-api","depth":2},{"value":"Headers","id":"headers","depth":2},{"value":"Signature Calculation","id":"signature-calculation","depth":2},{"value":"JavaScript Example","id":"javascript-example","depth":3},{"value":"Authentication Tokenization API","id":"authentication-tokenization-api","depth":2}],"frontmatter":{"seo":{"title":"🚀 Getting started"}},"lastModified":"2026-04-29T16:49:15.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/getting-started","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}