Getting Started

With the Treasure API, you can integrate our suite of cash management services directly into your platform. Manage your businesses, portfolios, transfers, documents, and bank accounts on your own time with our RESTful API.

Accessing APIs

You can access our API through two environments, sandbox and production. The sandbox environment allows simulating an integration before going live in the production environment. Exact endpoints and per-environment base URLs available in the API Reference.

Retrieve Credentials

To get started with our APIs, contact your Treasure integration team to receive your Client ID and Client Secret keys.

Your Client ID and Client Secret pair will be emailed to you via a single-use secure transfer mechanism. While your Client ID will not change, you can request a new Client Secret from Treasure directly by reaching out to your integration support team. Make sure to keep your credentials somewhere safe, as you may need to access them again.

Once you have your Client ID and Client Secret, you can create your OAuth token, which is used to authenticate all API calls. To receive your OAuth token, make the following call to POST /v1/oauth/token: 

{
  "client_id": "1234567890",
  "client_secret": "1234567890"
}

The response will look something like this:

{
  "expires_in": 83725,
  "access_token": "eyJhbGciOiJSUzI1NiIsI...",
  "token_type": "Bearer"
}

The response returns an access token, its expiration time, and the token type. In our sandbox and production environments this token will be "Bearer," and the token has a TTL (time-to-live) of 24 hours.

Note: expires_in is in seconds, so 24 hours would be a value of 86400.

access_token is to be used as part of your Authorization header for subsequent API requests. For example, a call to list all businesses would look like the following:

curl --request GET \
  --url https://sandbox.treasurefinancial.com/v1/businesses \
  --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsI...'

As a best practice, you should plan to call the OAuth Token API in the following cases:

• Your server does not have an access token cached and available for use.
• You receive a 401 HTTP response code for an API request.
• The expiration time for your OAuth token has elapsed or is nearing expiration.

Define User Data

As seen in various endpoints in the Treasure API (e.g., here), a user_data object can be passed containing arbitrary data. This allows for correlating entities in your own system to Treasure's entities. user_data info will be returned any time that entity is returned, including in webhooks.

Webhooks

Our APIs send webhooks to a URL of your choice, configured through your webhooks dashboard (powered by Svix). Throughout this integration guide, you’ll see references to webhooks and how they tie into various user flows.

Access your webhooks dashboard via the link returned by the webhooks dashboard endpoint. The link provided in the API response provides authentication to your webhooks dashboard. As a matter of best practice, we recommend that you:

• Do not save the URL provided in the API response, as the auth token in the link in the response is short-lived.
• Protect access to this URL to ensure only individuals that are expected to manage or view webhook configurations can access it.

The webhooks dashboard provides an event catalog for viewing event types and payload structures. Webhook shapes are also available in the API reference. Note that SSNs will not appear in webhooks for security purposes.

For more information on how to configure and receive webhooks to your application, please refer to the Svix documentation.