> For the complete documentation index, see [llms.txt](https://docs.prozora.network/bank-integration/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prozora.network/bank-integration/eng/api-methods/authentification/bank-authorization.md).

# Bank authorization

to authorize actions in DCM

The Bank should implement a service authorizing DCM actions. JWT specifies "who" (subject) intends to do with "what" (object). The content of JWT must comply with the requirements (see [JWT format](/bank-integration/eng/api-methods/authentification/jwt-format.md)).

{% hint style="success" %}
**May I use my own JWT?**

Yes! You can use [your own JWT](https://app.gitbook.com/o/3rqUDMSaToZXFIIeVuRh/s/tSAbV2p2auxzoLyMptKl/~/diff/~/changes/159/api-methods/authentification-in-api/authentification-with-jwt), but remember to share your public key with us.

The token format is described below. \
It should be sent in the header`CX-Authorization`.

Please note we do not check any [permission rules ](/bank-integration/eng/api-methods/emlpoyee/role-management.md)for requests with your own JWT: authorization is done on your side. 
{% endhint %}

If the service found out that the subject is permitted to manipulate the object, a successful response (see details below) should be sent. Otherwise an HTTP 401 (Unauthorized) should be used.

## Callback methods <a href="#api-methods" id="api-methods"></a>

All URIs are relative to main host.

<table><thead><tr><th width="121">Method</th><th width="132">Path</th><th width="224">Purpose</th><th>"obj" content</th></tr></thead><tbody><tr><td>GET</td><td>/user_auth</td><td>user data based on "obj"</td><td>Customer Login</td></tr><tr><td>GET</td><td>/key</td><td>user secret key </td><td>external id</td></tr><tr><td>GET</td><td>/external_id</td><td>authentication</td><td>external id</td></tr></tbody></table>

{% hint style="info" %}
It is expected for each method to respond within 1 second.&#x20;
{% endhint %}

### 1. GET /user\_auth <a href="#get-user_auth" id="get-user_auth"></a>

Request example:&#x20;

<pre class="language-json"><code class="lang-json"><strong>curl "https://{bank's auth host}/user_auth" --header "X-Session-ID:token"
</strong></code></pre>

Response example:

```json
{
"external_id":"123456789", // up to 500 symbols
"first_name":"mock",
"last_name":"mock",
"email":"mock@email.com",
"phone":"+12345678901",
"key":"secret"
}
```

Attributes `external_id` and `key` are obligatory in response.

### 2. GET /key <a href="#get-key" id="get-key"></a>

Request example:

```json
curl "https://{bank's auth host}/key" --header "X-Session-ID:token"
```

Response example:

```json
{
"key":"secret"
}
```

### 3. GET /external\_id <a href="#get-external_id" id="get-external_id"></a>

Request example:

```json
curl "https://{bank's auth host}/external_id" --header "X-Session-ID:token"
```

Response example:

```json
{
"external_id":"123456789"
}
```