Skip to main content
Two things identify a request: your integration and the Broco account involved. Your integration authenticates with a secret. The account is always linked through a connection that its owner authorized.

​
Integration secret

Broco issues an integration secret to your platform. It authenticates every server-to-server request.
Request header
Keep the secret on your server. Never send it to a browser, a mobile app or a carrier’s device.
The secret identifies your integration. It does not authorize spending on its own: each account involved must be connected, and supplier payments also need the approval of an authorized user.

​
Account connections

A connection links a Broco account to your platform. The account owner creates it by signing in to Broco and giving consent. Your server stores the connection identifier and sends it in later requests. Customers who pay in cash and recipients of deliveries do not connect an account.
1

Start the connection

The account owner selects Connect Broco in your platform. Your platform redirects them to Broco.
2

Sign in and consent

They sign in to Broco, review what your platform will be allowed to do, and approve.
3

Store the connection

Broco returns them to your platform. Your server receives and stores the connection identifier.
The owner can revoke a connection from Broco at any time. Requests that use a revoked connection fail with connection_not_authorized.

​
Server and browser responsibilities

The browser never chooses the account that receives funds. A redirect back to your website does not prove that a payment succeeded.

​
Idempotency

Every creation request carries an Idempotency-Key. If the same request is sent again with the same key, Broco returns the original object and does not create a second one.
Request header
See Errors & retries for retry rules.