Provisioning
How the gateway onboards you into a product on your behalf using the product's privileged service key.
Provisioning puts you into a product for a given context. The gateway holds the product's privileged service key and calls the product's service-authenticated provision operation on your behalf — you never see or hold that service key.
POST /products/{product}/provisionSelect the context with the One-Context header. The gateway provisions the partner
into the product for that context and returns the product's own credential, once.
You then authenticate to the product directly with that credential.
The gateway records correlation only
The gateway records only that you have a tenant in the product — never the tenant's positions or balances. It holds the partner → context → product-tenant mapping, and nothing about the money.
Idempotency
Provisioning is idempotent on the Idempotency-Key header: a retried provision with
the same key returns the original result rather than creating a second tenant.
Fail-closed
Entitlement is checked first. A partner not entitled to the product is denied before the product is contacted. If the product's provision fails or the service key is rejected, no partial identity is left behind, and the service key is never leaked.
After provisioning
With a tenant in place, reach the product through Passthrough. The credential returned here is what the gateway threads downstream on your calls.
Next
- Passthrough — making calls into the provisioned product.
- Errors — including
provision_failed.