Skip to main content

Partner Onboarding

A condensed flow for becoming a Kesles Merchant partner from kickoff to production go-live.

1. Kickoff​

Contact the Kesles Partner team at partner@kesles.com with:

  • Partner / company name
  • Integration use case (referral, analytics, scoring, etc.)
  • Product PIC + technical PIC (name, email, phone)
  • Estimated request volume per day
  • Target environment (staging first, then production)

2. Sign NDA + Partner Agreement​

The Kesles team will send:

  • A standard NDA
  • The Partner Agreement (data scope, SLA, rate limit, data retention)

Once both documents are signed, provisioning begins.

3. Credential Provisioning​

The Kesles team will issue:

  • partner_id (UUID)
  • credential_key (public identifier — safe to log)
  • credential_secret (⚠ delivered via an encrypted channel, not plain email)
  • Access to the staging environment

Store the credential_secret in a partner-side secret manager. Do not commit it to a repo or share it via plain-text chat.

4. Staging Integration​

Use the credential_key + credential_secret to exchange them for an access token:

POST /api/partner/v1/auth/token
Content-Type: application/json

{
  "credential_key": "<key>",
  "credential_secret": "<secret>"
}

Use the resulting access_token to call Partner API endpoints (all under the api-merchant.kesles.com domain, with /api/partner/v1 prefix):

  • GET /api/partner/v1/partners/{partner_id}/referral-merchants — merchant.read scope
  • GET /api/partner/v1/partners/{partner_id}/referral-merchants/summary — merchant.read scope
  • GET /api/partner/v1/merchants/{merchant_id}/transactions — transaction.read scope
  • GET /api/partner/v1/merchants/{merchant_id}/scoring-summary — scoring.read or risk-summary.read scope

See the Partner API Reference for full endpoint details.

5. UAT Checklist​

Before going to production, partner + Kesles team must verify:

  • Auth token exchange works
  • Retry + backoff implemented on the partner side
  • Error handling for 401 (token expired), 429 (rate limit), 5xx
  • No credentials leaking in logs / error traces
  • Partner can only access merchants within its referral scope
  • Partner-side observability is on (request IDs captured)
  • 60 req/min rate limit not exceeded under normal traffic

6. Go-Live​

After UAT is approved:

  • Kesles team switches credentials to production + shares the production URL
  • Partner deploys to production
  • Joint monitoring for the first 7 days

7. Credential Rotation​

  • Default rotation: 90 days
  • Partner can request an early rotation any time via the support channel
  • Dual-key grace period of 7 days (old key + new key both active)

Support Channels​

Next Steps​