Preview

Create credential reference

POST
/credential-owners/{ownerAccountID}/credential-references

Create a pending private_key_jwt credential reference for your owner account. Moov Money determines whether the owner is an FI or integrator from the account. You do not send an owner type. An account registered as both returns 409.

Registration: create the reference, give its returned jwksURL to the receiver as-is; do not construct the opaque URL. Wait for the receiver to issue a client ID, then complete the reference with that client ID.

Returns 201 with the pending reference. Returns 400 when the request is invalid, 401 when your credentials are missing or invalid, 403 when the authenticated caller is not the owner account, 404 when the owner account is not found, and 409 when the owner account is both an FI and an integrator.

Auth: API key or bearer token. Requires the moov-money-config.write scope on the owner account.

Request
cURL
curl -X POST https://api.moov.money/credential-owners/{ownerAccountID}/credential-references \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00" \
  -H "Content-Type: application/json" \
  -d '{
  "clientAuthenticationMethod": "private_key_jwt",
  "keyAlgorithm": "ES256"
}'
Responses
201 400 401 403 404 409
The resource was successfully created.
{
  "clientAuthenticationMethod": "private_key_jwt",
  "keys": [
    {
      "algorithm": "ES256",
      "state": "active"
    }
  ],
  "ownerAccountID": "acc_01HF5J9ZKQT4RXP8M2VYBN3D",
  "ownerType": "fi",
  "state": "pending"
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.
The request conflicts with the current state of the target resource.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

ownerAccountID

string required
The account that owns this credential reference. The authenticated caller must be this account.

Request

application/json
Create a credential reference for private-key client authentication.

clientAuthenticationMethod

string<enum> required
Client authentication method. Only private_key_jwt is supported.
Possible values: private_key_jwt

keyAlgorithm

string<enum>
Signing algorithm for the key. Defaults to ES256.
Possible values: ES256, PS256, RS256

Response

A credential reference and its active or next public signing keys.

credentialReferenceID

string required
Identifier assigned to this credential reference.

ownerType

string<enum> required
Owner kind derived by Moov Money from the owner account.
Possible values: fi, integrator

ownerAccountID

string required
Account that owns this credential reference.

clientAuthenticationMethod

string<enum> required
Client authentication method used by this reference.
Possible values: private_key_jwt

state

string<enum> required
Reference state: pending, active, or revoked.
Possible values: pending, active, revoked

clientID

string required
Receiver-issued client ID. Empty while the reference is pending.

tokenURL

string required
Receiver token endpoint URL. Empty while the reference is pending.

scopes

array | null required
Scopes configured for the reference. This is null until configured.

audience

string
Configured token audience, when present.

resource

string
Configured resource indicator, when present.

jwksURL

string required
Opaque JWKS URL returned by Moov Money. Use this value as-is when registering with the receiver; do not construct it.

keys

array<object> required
Active and next key metadata. Retired keys are not returned.
Show child attributes

keys[]

keyID

string required
Identifier assigned to this key.

algorithm

string<enum> required
Signing algorithm used by this key.
Possible values: ES256, PS256, RS256

state

string<enum> required
Key state: active or next.
Possible values: active, next

createdOn

string<date-time> required
Time when the key was created.

createdOn

string<date-time> required
Time when the reference was created.

updatedOn

string<date-time> required
Time when the reference was last updated.

revokedOn

string<date-time> | null required
Time when the reference was revoked, or null if it has not been revoked.