Integration Guide for Developers
A guide for integrating with NewDay APIs and environments using mutual Transport Layer Security protocol.
The information on this page is for authentication with all our APIs except Open Banking. For information on integrating with our Open Banking APIs, see the Open Banking Authentication Guide.
NewDay requires mutual Transport Layer Security (mTLS) protocol version 1.2 or above for any certificate authentication, so requests must be sent only via HTTPS channels. Each environment will require a separate certificate and will have a separate URL (e.g., User Acceptance Testing and Production environments).
- To access our APIs, you must obtain a certificate from NewDay’s private Certificate Authority (CA). Public CAs such as GlobalSign/Digicert/Sectigo no longer issue certificates with the required “Client Authentication” usage so cannot be used. For an overview of mTLS, see a general explanation from Cloudflare here.
- Your client certificate is used to uniquely identify you as the caller of our services and should be named as such (e.g., org-service-mtls-env). NewDay will issue your nonprod certificates from a test CA, and your production certificates from a production CA.
- Depending on your product set, you may also be required to provide the calling IP addresses for allowlisting. All information should be provided through your Account Manager, they will be able to assist with any further questions.
Client environments are deployed and smoke tested in phases. Your Account Manager can provide information on the status of your environment and which services are available in each environment. Once you have confirmation:
- You include the client certificate in the request header.
- We authenticate the request and validate the certificate.
- You can access the endpoints and verify the response.
As above, client environments are deployed and smoke tested in phases. Your Account Manager can provide information on the status of your environment and which services are available in each environment.
- You include the client certificate in the request header.
- We authenticate the request and validate the certificate.
- You can access the endpoints and verify the response.
NewDay supports multiple concurrent certificates to ensure seamless transition, avoiding any interruption of service. This enables you to provide a new certificate in advance of the existing certificate's expiry.
Still have questions
Can't find the answer to your question? Our friendly team is more than happy to help