Skip to main content

First API Call (Production)

Production Transactions – Real Money Movement!

This is the production environment. Every transaction results in real money movement!

Now that all setup steps are complete, make your first production API call – carefully!

Technical Prerequisites​

  • RPP registration complete (production portal)
  • API user created
  • Permissions set
  • Authentication configured (CSR/JWT or HMAC)
  • Credentials extracted and stored securely
  • Testing was successful
Payment API users

Don't forget that for the Payment API, Consent creation and approval (production) is still required!

Production Environment URLs​

API base URL (production):

https://premium-api.raiffeisen.hu

Pay Portal (production):

https://payportal.raiffeisen.hu
Difference from sandbox
  • URL has NO -pc suffix
  • 24/7 availability (not 7-20)
  • Real transactions

Setting HTTP Headers​

CSR/JWT-based authentication (Payment API, EAM, Payment Request)​

Required headers:

HeaderValueDescription
x-api-keyFrom RPP portalThe API key bound to the technical user (TECHUSER). A company can have multiple TECHUSERs and thus multiple x-api-key values.
x-jws-signatureDetached JWTThe signature computed on the request body. Format: header.signature (payload omitted). Details: JWS signature generation
x-correlation-idUUID v4Request identifier for searching in logs. Unique value for each call.
x-request-idUUID v4Technical identifier for searching in logs. Unique value for each call.
user-agentAny stringRequired header, content can be anything (e.g. MyApp/1.0.0).
Content-Typeapplication/jsonFormat of the request body.

JWS signature generation:

A Detached JWS signature is created from the request body for each API call. This is not an OAuth2 bearer token – there is no expiry, a new signature is required for each call.

Detailed guide: JWS Signature Generation

HMAC-based authentication (Online Payment Page)​

Detailed guide: HMAC Authentication (production)

First Production Calls by Product​

Balance API​

Detailed documentation: Balance API →

Payment API​

Detailed documentation: Payment API →

qvik EAM​

Detailed documentation: qvik EAM →

Payment Request​

Detailed documentation: Online Payment Page →

Common Errors​

401 Unauthorized​

Possible causes:

  • Incorrect JWT token or API key
  • Expired certificate (CSR/JWT)
  • Wrong KID in JWT header
  • Wrong HMAC signature

Solution:

  • Check that the KID is correct
  • Check that you signed the JWT with the private key
  • Check the API key
  • Check certificate expiry (openssl x509 -in cert.pem -noout -dates)

403 Forbidden​

Possible causes:

  • Insufficient permissions
  • Expired Consent (Payment API)
  • Timestamp too old (> 5 min) (HMAC)
  • Deactivated API user

Solution:

  • Check permissions on the RPP portal
  • Check Consent expiry (Payment API)
  • Synchronize clock (NTP)
  • Check API user status on RPP

400 Bad Request​

Possible causes:

  • Incorrect payload format
  • Missing required field
  • Invalid amount (negative, too large)
  • Invalid account number format

Solution:

  • Validate the payload with JSON schema
  • Check required fields in the product documentation
  • Check the amount format (integer, in fillér)

500 Internal Server Error​

Possible causes:

  • Bank backend issue
  • Incorrect configuration
  • Network timeout

Solution:

  • Check production environment availability (24/7 but may have maintenance)
  • Retry with exponential backoff
  • Contact 24/7 support: premiumapi_support@raiffeisen.hu or +36 80 488 588