Mono Authentication: API Keys, Security, and Best Practices (2026)

Authentication overview

Mono employs a robust authentication system to ensure secure access to financial data. The primary method for server-side API interactions involves the use of API keys, which act as unique identifiers and authenticators for your application. These keys are generated and managed within the Mono dashboard, providing developers with control over their application's access permissions. For client-side interactions, such as initiating a connection to a financial institution, Mono leverages its Connect widget, which simplifies the user authentication flow while keeping sensitive credentials secure and compliant with relevant data protection standards like NDPR (Nigeria Data Protection Regulation) and PCI DSS (Payment Card Industry Data Security Standard) Mono NDPR compliance details.

The authentication process is designed to be straightforward for developers while maintaining high security. When making API calls from a server, the API key must be included in a specific HTTP header. For user-facing actions that require direct interaction with financial institutions, the Connect widget handles the secure transmission of credentials, ensuring that your application never directly stores or processes sensitive bank login details. This architecture helps mitigate risks associated with credential exposure and simplifies compliance efforts for developers building fintech applications.

Supported authentication methods

Mono primarily supports API key authentication for server-to-server communication and embeds a secure widget for client-side user interactions with financial institutions. Each method is designed for specific use cases to optimize security and developer experience.

API keys serve as the primary credential for your application to interact with Mono's backend services. These keys are secret and should be treated with the same confidentiality as passwords. The Mono Connect widget, on the other hand, uses a public key to initialize its interface and facilitate the secure, direct connection between an end-user and their financial institution. This design pattern ensures that sensitive user login credentials never pass through your application's servers, enhancing overall security and reducing your compliance burden. This approach is consistent with best practices for handling sensitive user data in open banking environments, as outlined by organizations like the OpenID Foundation for secure identity layers OAuth 2.0 grant types overview.

Getting your credentials

To begin using Mono's APIs, you need to obtain your API credentials from the Mono dashboard. These credentials consist of both a secret key for server-side operations and a public key for client-side integrations with the Mono Connect widget.

1. Sign Up/Log In to Mono Dashboard: Navigate to the Mono homepage and either sign up for a new account or log in to your existing one.
2. Access Developer Settings: Once logged in, locate the 'Settings' or 'Developer' section within your dashboard. This area typically contains options for managing your API keys and webhooks.
3. Generate API Keys: Within the developer settings, you will find options to view or generate your API keys. Mono provides distinct keys for different environments (e.g., development, production) to help manage your API usage and security.
• Secret Key: This key is used for authenticating server-side requests to Mono's APIs. It must be kept confidential and never exposed in client-side code.
• Public Key: This key is used to initialize the Mono Connect widget on your client-side application. It is safe to expose in your frontend code as it does not grant direct API access.
4. Copy and Store Keys Securely: Copy your generated keys and store them in a secure location. For secret keys, environment variables or a secure vault are recommended practices, rather than hardcoding them directly into your application's source code. Refer to the Mono documentation on API keys for detailed instructions.

It's crucial to understand the distinction between your public and secret keys and to use them appropriately to maintain the security of your application and your users' data.

Authenticated request example

Authenticating with Mono's APIs for server-side operations involves including your secret API key in the mono-sec-key HTTP header. The following examples demonstrate how to make an authenticated request using popular programming languages, fetching account details as a typical use case. These examples assume you have already obtained an account_id from a connected user via the Mono Connect widget.

Node.js Example

This Node.js example uses the axios library to make a GET request to retrieve a user's account information.

const axios = require('axios');

const MONO_SECRET_KEY = process.env.MONO_SECRET_KEY; // Stored securely as an environment variable
const ACCOUNT_ID = 'YOUR_ACCOUNT_ID'; // Obtained from Mono Connect

async function getAccountDetails() {
  try {
    const response = await axios.get(`https://api.mono.co/accounts/${ACCOUNT_ID}`, {
      headers: {
        'mono-sec-key': MONO_SECRET_KEY,
        'Content-Type': 'application/json'
      }
    });
    console.log('Account Details:', response.data);
  } catch (error) {
    console.error('Error fetching account details:', error.response ? error.response.data : error.message);
  }
}

getAccountDetails();

Python Example

This Python example uses the requests library to perform the same operation.

import os
import requests

MONO_SECRET_KEY = os.environ.get('MONO_SECRET_KEY') # Stored securely as an environment variable
ACCOUNT_ID = 'YOUR_ACCOUNT_ID' # Obtained from Mono Connect

def get_account_details():
    headers = {
        'mono-sec-key': MONO_SECRET_KEY,
        'Content-Type': 'application/json'
    }
    try:
        response = requests.get(f'https://api.mono.co/accounts/{ACCOUNT_ID}', headers=headers)
        response.raise_for_status() # Raise an exception for HTTP errors
        print('Account Details:', response.json())
    except requests.exceptions.HTTPError as e:
        print(f'Error fetching account details: {e.response.json()}')
    except requests.exceptions.RequestException as e:
        print(f'Request failed: {e}')

if __name__ == '__main__':
    get_account_details()

These examples illustrate the critical role of the mono-sec-key header in authenticating your requests. Always ensure your secret key is loaded from a secure source and never hardcoded into your application.

Security best practices

Securing your Mono integration is paramount to protecting both your application and your users' financial data. Adhering to security best practices helps mitigate common vulnerabilities and ensures compliance with data protection regulations.

1. Protect Your Secret API Keys:
   • Environment Variables: Store your MONO_SECRET_KEY as an environment variable or in a secure configuration management system. Never hardcode it directly into your application's source code or commit it to version control (e.g., Git). This prevents accidental exposure in public repositories.
   • Access Control: Limit access to your API keys only to authorized personnel and systems that require them. Implement role-based access control (RBAC) where possible.
   • Key Rotation: Regularly rotate your API keys, especially if you suspect a compromise or as part of a routine security policy. The Mono dashboard provides functionality to generate new keys and revoke old ones.
2. Use HTTPS/TLS: All communication with Mono's APIs should occur over HTTPS (HTTP Secure) to encrypt data in transit. This protects against eavesdropping and man-in-the-middle attacks. Mono's API endpoints automatically enforce HTTPS Mono API introduction.
3. Secure Client-Side Integration with Mono Connect:
   • Public Key Only: Only use your public key when initializing the Mono Connect widget on the client side. Never expose your secret key in frontend code.
   • Referrer Restrictions: Configure referrer restrictions for your public key in the Mono dashboard to ensure it can only be used from your approved domains. This prevents unauthorized usage of your public key on other websites.
   • Verify Webhooks: If you use Mono webhooks for real-time notifications, always verify the signature of incoming webhooks to ensure they originate from Mono and have not been tampered with. Mono provides a signature in the mono-webhook-signature header for verification Mono webhook guide.
4. Input Validation and Error Handling:
   • Validate All Inputs: Implement robust input validation for any data your application sends to Mono's APIs. This helps prevent injection attacks and ensures data integrity.
   • Handle Errors Gracefully: Implement comprehensive error handling to manage API responses, especially error codes. Avoid exposing sensitive error details to end-users.
5. Least Privilege Principle: Grant your application and API keys only the minimum necessary permissions required to perform their functions. Avoid using highly privileged keys for processes that only need limited access.
6. Regular Security Audits: Conduct regular security audits and penetration tests on your application to identify and address potential vulnerabilities. Stay updated with security advisories from Mono and the broader cybersecurity community.

By implementing these practices, developers can significantly enhance the security posture of their applications integrating with Mono, protecting sensitive financial data and maintaining user trust. For broader guidance on API security, resources like the OWASP API Security Top 10 provide valuable insights OWASP API Security Project.