Configure mTLS

Set up Mutual Transport Layer Security (mTLS) on your Klarna account to add an extra layer of authentication on top of API key credentials, including issuing, enforcing, and rotating client certificates.

Mutual Transport Layer Security (mTLS) is an enhanced communication security mechanism that adds extra layers of protection to make it more difficult for attackers to misuse leaked credentials. It ensures that both the client and server authenticate each other, making the communication more secure.

Klarna recommends Partners to enable mTLS to strengthen the security of their integration. mTLS can be enabled and enforced by the Partner at any time, on top of the standard API key authentication.

Configuration details

Create and store your private key using elliptic curve cryptography with the prime256v1 specification.
- Example: creation command for certificate key

BASH

1 2

openssl ecparam -genkey -name prime256v1 -out my-key-file.pem

Create a Certificate Signing Request (CSR)
- The Common Name (CN) in the CSR should be the last part of your account ID.
- For example, if your account ID is krn:partner:global:account:live:LYABCDEI, the CN should be LYABCDEI.
- Example: creating a Certificate Signing Request (CSR)

BASH

1 2

openssl req -new -key my-key-file.pem -out csr.pem -subj "/CN=LYABCDEI"

With the Certificate Signing Request (CSR) previously generated, create a certificate using the createCredentialsClientCertificate endpoint and the certificate will be returned in the API-response. Now your account is in an mTLS enabled state, but not enforced. This is done so that the status of the mTLS configuration can be verified safely before enforcing access.
Store the generated certificate and configure it to be used in your runtime environment together with the private key.
- Example using curl which will list the newly created certificate

BASH

1 2

curl  --cert certificate.pem --key private-key.pem  -H "Authorization: Basic $API_TOKEN" https://api-global.klarna.com/v2/account/integration/credentials/client-certificate

After the certificate has been returned, the APIs will return a response header including the status of the mTLS verification. The header returned is Klarna-Mtls-Verification-Status and the value is one of NOT_PRESENT, VALID and INVALID so that the configuration can be verified before enforcing.
When the integration has been set up and requests return VALID status it's time to enforce access security. This can be done using the enforceMTLSAuthorization endpoint.
- Example using curl to enforce mTLS to a specific time in the future.
- The enforced_from timestamp should meet the following criteria:
  - The enforcement time cannot be in the past.
  - The enforcement time can be NOW.
  - The enforcement time can be at most 3 months in the future.
- Note: The enforcement takes up to 5 minutes from the configured timestamp.
- The response from the request shows the applied enforcement via status verbs, ENFORCED or REPORTING.

BASH

1 2

curl -X PUT --cert certificate.pem --key private-key.pem -H "Content-type: application/json" -H "Authorization: Basic $API_TOKEN" https://api-global.klarna.com/v2/account/integration/client-certificates/enforcement -d '{"enforced_from": "2025-12-12T00:00:00Z"}'

There is a readMTLSAuthorizationEnforcementStatus endpoint available to get the enforcement status.
- Example using curl to get mTLS enforcement status.
- Make sure to use the certificate in the request if the enforcement time used in the previous step has passed.

BASH

1 2

curl -X GET --cert certificate.pem --key private-key.pem -H "Authorization: Basic $API_TOKEN" https://api-global.klarna.com/v2/account/integration/client-certificates/enforcement

At the enforcement time the mTLS client certificate will be verified on all API-requests and the status header will stop being returned.

Disable mTLS enforcement for your Klarna account

mTLS enforcement can be disabled by deleting the enforcement time (set from the above steps). This can be done using the removeEnforcementOfMTLSAuthorization endpoint.
- Example using curl to delete mTLS enforcement.

BASH

1 2

curl -X DELETE --cert certificate.pem --key private-key.pem -H "Authorization: Basic $API_TOKEN" https://api-global.klarna.com/v2/account/integration/client-certificates/enforcement

Important notes

CSR Requirements: The CSR should only include the CN and no extra attributes.
Certificate Validity: The issued certificate is valid for 3 years. You need to monitor its expiration and initiate the renewal process in advance.
Multiple Certificates: You can have up to 10 active certificates at a time.
Revoking Certificates: Before revoking an active certificate, ensure a new certificate is issued and installed. Use the revokeCredentialsClientCertificate endpoint to revoke the certificate.

Certificate rotation process

1.
Issue a new certificate following the steps above to create and submit a CSR.
2.
Install and test the new certificate, ensuring it works correctly.
3.
Revoke the old certificate using the Partner API after confirming the new one is functioning.
4.
By following these steps, you can ensure a secure and smooth setup of mTLS for your Klarna account.

API & SDK references

Create a client certificate

Enforce MTLS authorization

Read mTLS authorization enforcement status

Remove enforcement of MTLS authorization

Revoke a Client Certificate