How voucher providers register and obtain API credentials.
What is a Voucher Provider?
A voucher provider is an external organisation that issues voucher codes into the FinWallet
platform. Providers submit batches of voucher codes via the Provider API, and those vouchers
are then available for users to claim into their wallets.
Examples of providers include retailers, network operators, and rewards programme operators.
Getting Set Up as a Provider
-
Request access — Email support@finwallet.co.za
with your organisation name, the programme you'd like to issue vouchers for, and a brief
description of your integration use case.
-
Provider account creation — The FinWallet admin team will create your
provider account and link it to the relevant wallet programme.
-
Receive credentials — Once approved, you'll receive an invitation to the
Provider Portal where you can generate and manage your API credentials.
-
Obtain your API token and HMAC secret — Log in to the Provider Portal,
navigate to API Credentials, and generate your bearer token and signing secret.
Store these securely — the secret is only shown once.
-
Test your integration — Use the credentials to submit a small test batch
via the Provider API. Confirm the vouchers appear in your Provider Portal dashboard.
-
Go live — Once your test is successful, you're ready to submit production batches.
Security: Your API token and HMAC signing secret must be treated as sensitive
credentials. Do not commit them to source control or share them. If a credential is compromised,
regenerate it immediately from the Provider Portal.
Provider Portal Access
The Provider Portal is available at
https://www.finwallet.co.za/provider/login.
Use your provider credentials to log in. The portal shows:
- Your voucher ingest history and status per batch
- Current voucher statuses (active, claimed, redeemed, expired)
- API credential management (view, regenerate)
Rotating Your API Credentials
You can regenerate your API token from the Provider Portal at any time. Once regenerated,
the previous token is immediately invalidated. Update your integration before regenerating
to avoid downtime.