Authentication

👋
Please get in touch
If you would like access to our staging environment to begin interacting with our APIs, please get in touch with your implementation manager, or at [email protected] so we can provide you with API credentials.

To call a YouLend API:

1. Get a token: Send your client ID, client secret and the API’s audience value to the token endpoint.

2. Call the API: Send the returned token as a Bearer token to the appropriate regional API host.

Auth tokens

Having trouble authenticating? See here.

YouLend uses the Client Credentials flow from OAuth 2.0 to secure the API endpoints.
To request an access token for any of the APIs, perform a POST operation to one of the following endpoints:

Location	Staging URL	Production URL
Europe	`https://youlend-stag.eu.auth0.com/oauth/token`	`https://youlend.eu.auth0.com/oauth/token`
USA	`https://youlend-stag.eu.auth0.com/oauth/token`	`https://youlend-us.us.auth0.com/oauth/token`

Send the token request in the following format:

curl --request POST \
  --url 'https://youlend-stag.eu.auth0.com/oauth/token' \
  --header 'Content-Type: application/json' \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "CLIENT_ID",
    "client_secret": "CLIENT_SECRET",
    "audience": "API_IDENTIFIER"
  }'

The audience identifies the API that the token will be used to access. Select the appropriate audience value below. The OAuth client must also be enabled for that API.

API audience values

API	Staging audience (Europe and USA)	Europe production audience	USA production audience	Required Auth0 API access
Onboarding	`https://staging.youlendapi.com/onboarding`	`https://youlendapi.com/onboarding`	`https://youlendapi.us/onboarding`	Third Party Onboarding API
Notification	`https://staging.youlendapi.com/notification`	`https://youlendapi.com/notification`	`https://youlendapi.us/notification`	Third Party Notification API
Preapproval	`https://staging.youlendapi.com/preapproval`	`https://youlendapi.com/preapproval`	`https://youlendapi.us/preapproval`	Third Party PreApproval API
Prequalification	`https://staging.youlendapi.com/prequalification`	`https://youlendapi.com/prequalification`	`https://youlendapi.us/prequalification`	Third Party PreQualification API
Loan	`https://staging.youlendapi.com/loan`	`https://youlendapi.com/loan`	`https://youlendapi.us/loan`	Third Party Loan API
Test Support	`https://staging.youlendapi.com/testsupport`	Not supported	Not supported	Third Party Test Support API
Fast Track	`https://staging.youlendapi.com/onboarding/fasttrack`	`https://youlendapi.com/onboarding/fasttrack`	`https://youlendapi.com/onboarding/fasttrack`	Third Party Onboarding FastTrack API

Good to know
Test Support is available in staging only.

A successful response (200) contains a signed JSON Web Token (JWT), the token's type (Bearer), and lifetime in seconds (86400, equal to 24 hours).

{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 86400
}

🚧
Be aware
Tokens are valid for 24 hours. Reuse a valid token until it expires instead of requesting a new token for every API call. Use the expires_in value to manage token renewal.

Calling an API

After obtaining an access token, send the API request to the host for the merchant’s region and environment. The request host is used for the API call, not for obtaining the token.

The four request hosts are:

Region	Staging API host	Production API host
Europe	`https://partners.staging-youlendapi.com`	`https://youlendapi.com`
USA	`https://uspartners.staging-youlendapi.com`	`https://youlendapi.us`

Pass the retrieved access token as a Bearer token in the Authorization header of every API request.

For example:

curl --request POST \
  --url 'https://partners.staging-youlendapi.com/onboarding/leads' \
  --header 'Authorization: Bearer ACCESS_TOKEN' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data 'REQUEST_DATA'

👍
Try it out
You can also add the bearer token for an API directly in the API reference for each endpoint next to the Try it button to try API requests without leaving this site.

Troubleshooting 401 Unauthorized

Never share client secrets or access tokens when requesting support.
Token request:

Confirm that the client ID and client secret are correct for the selected environment.

Confirm that the audience exactly matches the API being requested.

Confirm that the OAuth client has access to the corresponding Auth0 API.

API request:

Confirm that the token was requested using the correct audience for that API.

Confirm that the token has not expired.

Check that the request includes Authorization: Bearer ACCESS_TOKEN.

Confirm that the API request host matches the correct region and environment.