Posteering

Provisioning

How the gateway onboards you into a product on your behalf using the product's privileged service key.

Provisioning puts you into a product for a given context. The gateway holds the product's privileged service key and calls the product's service-authenticated provision operation on your behalf — you never see or hold that service key.

POST /products/{product}/provision

Select the context with the One-Context header. The gateway provisions the partner into the product for that context and returns the product's own credential, once. You then authenticate to the product directly with that credential.

The gateway records correlation only

The gateway records only that you have a tenant in the product — never the tenant's positions or balances. It holds the partner → context → product-tenant mapping, and nothing about the money.

Idempotency

Provisioning is idempotent on the Idempotency-Key header: a retried provision with the same key returns the original result rather than creating a second tenant.

Fail-closed

Entitlement is checked first. A partner not entitled to the product is denied before the product is contacted. If the product's provision fails or the service key is rejected, no partial identity is left behind, and the service key is never leaked.

After provisioning

With a tenant in place, reach the product through Passthrough. The credential returned here is what the gateway threads downstream on your calls.

Next

  • Passthrough — making calls into the provisioned product.
  • Errors — including provision_failed.

On this page