Live Guide | Authentication Configuration

2 Authentication Configuration

Authentication configuration defines how the FI authenticates to Payvala APIs and what security mechanisms apply to requests and responses.

Configuration Screens

Refresh

Clicking Refresh reloads the current authentication configuration list and shows the latest saved status from POEMS.

Create Auth Config

Clicking Create Auth Config opens the next configuration pop-up where security layers are selected before moving to detailed form setup.

Update Organization Config

This button takes the user back to organization-level settings where related technical tabs and prerequisite configuration sections can be managed.

Security Layer Selection

Selecting checkboxes such as Application or Transport determines which security controls will be enabled in the next configuration step.

Cancel / Close

Clicking Cancel or the close icon exits the setup modal and returns the user to the previous auth configuration screen without saving changes.

Form Fields

Here the user sets Authentication Type, Payload Type, Signature Type, Transport Security, response encryption, and endpoint values.

Save

Clicking Save stores the selected authentication settings and returns the user to the main auth configuration tab with the new setup applied.

Next Result

After completing the previous modal and saving this form, the next visible state is the configured auth dashboard where the FI can review, edit, or refresh the saved configuration.

Setting Reference

Setting	Description
Authentication Type	JWT / OAuth / API Keys.
Payload Type	Encrypted / Plain.
Signature Type	JWS / None.
Transport Security	TLS / mTLS.
Response Encryption	Enabled / Disabled.
Key Rotation Days	Defines key lifecycle / rotation schedule.

Form Explanation

Authentication Type

Choose between JWT, OAuth, or API-key-based flows. This selection defines how the FI proves identity to Payvala APIs.

Payload Type

Choose between Encrypted and Plain. Use encrypted payloads when confidentiality requirements apply beyond transport encryption.

Signature Type Required

Select JWS when request signing and non-repudiation are required. Use None only for approved lower-security flows.

Transport Security

Configure TLS or mTLS. For FI-to-Payvala production connectivity, mTLS should be enabled to bind requests to the client certificate.

Response Encryption

Defines whether API responses are additionally encrypted. Enable this when the configured integration requires protected response payloads.

Key Rotation Days

Specifies the rotation cycle for active keys and signing material. The FI should align internal operational processes with this configured schedule.

JWKS / Public Key Endpoints

The public signing and encryption endpoints allow Payvala to validate signatures and exchange keys correctly across environments.

Mandatory Setup

Enable mTLS.

Configure JWKS endpoints.

Enable signature verification using JWS.

Define a clear key rotation policy.

Setup Workflow

Step 1: The default authentication type is JWT. Change it only if your approved integration requires OAuth or API keys.

Step 2: Enable mTLS and upload your root trust anchors.

Step 3: Configure JWKS endpoints for public key exchange.

Step 4: Save and test connectivity in the Staging sandbox.

Responsibility Matrix

FI Responsibility	Payvala Responsibility
Confirm the authentication mode and align Financial Institution implementation accordingly.	Enable and enforce the selected authentication configuration per environment.
Implement token retrieval, caching and renewal if OAuth is enabled.	Validate configuration during onboarding and certification.
Implement signing/encryption according to configured options.	Support troubleshooting and provide integration guidance.
Implement key rotation process aligned with configured rotation days.	Monitor and support the agreed authentication posture across the integration lifecycle.