Authentication
Use OAuth 2.0 Client Credentials to obtain an access token for every API call. Tokens are issued per app and per environment (Sandbox vs Production), and carry the product scopes you request.
Prerequisites
- Create an App in the Developer Portal (start with Sandbox).
- Subscribe the app to every product you intend to call. In Sandbox you can subscribe yourself; in Production the subscription needs approval. Subscribing to an Open Banking product for the first time prompts you to configure your OB App.
- Find your Client ID and Client Secret under App Settings → Credentials.
- Know the scope for each product you're calling (e.g., e_statement). Explore Our Products
A token grants only the scopes you ask for, so name every product you intend to call. You can cover several products with one token by separating their scopes with spaces — for example e_statement single_api — as long as your app is subscribed to each of them.
Request
https://test.api.neotek.sa/oauth2security/oauth2/tokenSandbox URL · in Production call https://api.neotek.sa
Production uses the same path on https://api.neotek.sa.
Headers:
| Parameter | Required | Description |
|---|---|---|
Content-Type | Required | application/x-www-form-urlencoded — this endpoint does not accept JSON |
Form fields — sent in the body, url-encoded:
| Parameter | Required | Description |
|---|---|---|
grant_type | Required | string. Always client_credentials; no other grant type is supported |
client_id | Required | string. Your app's client identifier, from App Settings → Credentials |
client_secret | Required | string. Your app's client secret, from the same place. Send it only from your server — never from a browser or mobile app |
scope | Required | string. The product scopes you are requesting, separated by spaces — for example e_statement single_api. Your app must be subscribed to every scope you ask for, and the token grants only the scopes you name. Explore Our Products lists the scope for each product |
Use Sandbox credentials on Sandbox endpoints and Production credentials on Production endpoints. Do not mix environments.
Example (curl)
1) Get an access token (Sandbox)
curl -X POST https://test.api.neotek.sa/oauth2security/oauth2/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials" \ -d "client_id=<CLIENT_ID>" \ -d "client_secret=<CLIENT_SECRET>" \ -d "scope=e_statement"Example response
{ "access_token": "eyJhbGciOi...<snip>", "token_type": "Bearer", "expires_in": 3600, "scope": "e_statement"}2) Call a Sandbox API with the token
curl https://test.api.neotek.sa/<product-base>/v1/<endpoint> \ -H "Authorization: Bearer <ACCESS_TOKEN>"Using the token
Include the token in every request header to a product endpoint:
Authorization: Bearer <ACCESS_TOKEN>Token lifetime: Respect the expires_in value; cache and reuse until expiry.
Refresh: Client Credentials flow does not return refresh tokens—request a new token when expired.
Common errors
| Error / HTTP | Likely cause | Fix |
|---|---|---|
400 invalid_scope | Either the product name in scope is wrong, or you are not subscribed to it | Check the product's scope name; if it's correct, subscribe (Sandbox) or request approval (Production) |
401 unauthorized_client | Invalid client ID or secret | Verify creds and match them to the endpoint (Sandbox vs Prod) |
429 rate limited | Exceeded limits | Add retry/backoff; review usage |