Skip to main content
The Credit Benchmark API uses machine-to-machine (M2M) authentication. We register machines, not people. A machine can be a server in your data centre or cloud, or someone’s laptop. Each one gets its own identity with us, and no one needs to type a username or password for it to connect. That identity is a pair of digital keys that you create on the machine:
  • The private key stays on the machine and proves it is the one making requests.
  • The public key is the matching half. You send it to us, we register it, and we use it to check that each request really comes from your machine.
Because the private key is never shared, there is no password or shared secret to lose.
The standard behind this is OAuth 2.0 with private key JWT client authentication (RFC 7523). Your machine signs a short-lived request with its private key, we check the signature against the public key you registered, and we then issue an access token. Keys use the ES256 algorithm on the P-256 elliptic curve.

​
Onboarding at a glance

1

Generate a key pair

Create an ES256 key pair on the machine that will call the API. See Key pair setup.
2

Send us the public key

Send only es256-public.pem, with the fingerprint and your onboarding details, to your Credit Benchmark contact.
3

Receive your onboarding pack

We register the key and send you an onboarding pack with your client details and runnable sample scripts.
4

Request access tokens

Your machine signs a short-lived client assertion with its private key and sends it to the token endpoint. We verify the signature against the public key registered under your KID and return an access token. See Request an access token.

​
What you receive back

Once we have registered your public key, we send you an onboarding pack. It holds three details that turn your key into a working login, plus example scripts in Python and Node.js. None of the details are secret, but keep them with your integration configuration.
The token endpoint is https://gateway.creditbenchmark.com/api/security/token and the audience value is cb-gateway-m2m-blue. Your onboarding pack includes both.