This guide walks through what you need to start calling the Qombo API: your API key, IP allow-listing, and the certificates Qombo uses to act on your behalf.

Authentication

API key

Qombo authenticates every request with an API key, sent in the x-api-key header. You receive your keys after completing the registration forms. The base URL is https://api.qombo.tech.

curl https://api.qombo.tech/vop/v1/verify \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "iban": "FR4412739000704297147417S68",
    "party": { "name": "Antoine Dupont" }
  }'

IP allow-listing

In staging and production, requests are only accepted from IP addresses you have registered. Fill out the IP allow-listing form to register yours.

The sandbox has no IP restriction — your sandbox API key is all you need to start.

Certificates

For some operations, Qombo acts on your behalf toward third parties, which requires certificates. Which ones you need depends on the modules you use.

QWAC — required for VOP

To authenticate with other PSPs in the EPC ecosystem, Qombo needs your QWAC certificate (public and private keys). It is stored securely and used for inter-PSP verification requests when you request verifications.

BDF mTLS — required for Sharing

To exchange data with the Banque de France FNC-RF platform on your behalf, Qombo needs the certificate you provided to the Banque de France along with your BDF credentials (organisation identifiers, client id, and client secret). These are provisioned per account and stored securely.

Internal mTLS — optional

On top of the API key, you can require mutual TLS between your systems and Qombo for an extra layer of transport authentication. It is optional and enabled per account.

When enabled:

Your requests go to a dedicated mTLS endpoint and must present your client certificate on every call.
Qombo validates the certificate on each request (authentication, validity dates, and issuer).

Contact Qombo to enable internal mTLS and exchange the certificate details.

Environments

Environment	IP allow-listing	Certificates
Sandbox	Not required	Not required
Staging	Required	Required (for the modules you use)
Production	Required	Required (for the modules you use)

When you're ready to go live, request your production API key, register your production IPs, and provide the production certificates for your modules. Then switch the key in your calls — no other change is needed.

Tools

Postman collection

To get started quickly, download our Postman collection and explore pre-configured API requests.

Download the Postman collection

Open API files

You can also download the OpenAPI specification files used in this documentation.

Open API specification - General documentation

Open API specification - Responding On Demand

Quick setup