Grant access via Deep Link

Implement the recommended access solution featuring two entry points: deep linking from your portal and an AP button on Klarna's login page. This complete package provides secure, passwordless access with the best user experience.

Overview

The recommended approach for granting access to Klarna Partner Portal combines two entry points that work together as a complete solution:

The two entry points

Entry Point	Description	Use Case
From Acquiring Portal	A button or link in your Partner-facing admin portal that uses the deep link API to provision access and redirect Partners directly to Klarna Partner Portal.	Partners already logged into your portal who want to access Klarna features.
From Klarna Partner Portal login	A button on Klarna Partner Portal's login page that redirects Partners to your authentication system, then provisions access via the deep link API.	Partners starting their journey from Klarna Partner Portal or bookmarking Klarna Partner Portal directly.

Both entry points use the same deep link API and JWT signing mechanism. You only need to implement the JWT generation once to enable both entry points.

Prerequisites

Before implementing this solution, ensure you have completed the common prerequisites.

Additionally, you will need:

Public-facing URL (for Klarna Partner Portal login) where Partners can authenticate

Important: This method requires JWT signing with a client certificate. If you haven't completed the JWT setup yet, follow the JWT signing setup in the Overview page first.

Implementation steps

Follow these steps to implement both entry points:

Build and sign your JWT

After completing the JWT signing setup, create your JWT with the following structure. Each request grants a user access to a single Partner Account, identified by the account_id claim, with one set of roles.

Sample header

JSON

1 2 3 4 5

{
  "alg": "ES256",
  "typ": "JWT",
  "x5c": ["<your_cert_base64>"]
}

Sample payload

JSON

1 2 3 4 5 6 7 8 9 10

{
  "iss": "krn:partner:global:account:live:LYABCDEI",
  "jti": "a4728c02-9885-41bf-b539-251ffa7f7eaa",
  "sub": "portal.user@merchant.com",
  "iat": 1716768000,
  "exp": 1716768060,
  "amr": ["pwd"],
  "account_id": "krn:partner:global:account:live:LYABCDEI",
  "on_behalf_of": "krn:partner:global:account:live:LYABCDEI",
  "roles": ["merchant:admin"]

Note: The amr (authentication methods reference) field is required for deep linking. It must include "pwd" to indicate password authentication is implemented on your side.

Payload structure

The JWT uses a flat payload that grants access to the Partner Account set in account_id with a top-level roles array.

Claim	Description
`iss`	Required. Partner Account ID of the requesting Partner.
`jti`	Required. Unique token ID. We recommend a UUID.
`sub`	Required. Email of the user to grant access to.
`iat`	Required. Issued-at timestamp, in seconds since the Unix epoch.
`exp`	Required. Expiry timestamp, in seconds since the Unix epoch. No more than 60 seconds after `iat`.
`amr`	Required. Authentication methods implemented on your side. Must include `"pwd"`.
`account_id`	Required. The Partner Account the user gets access to.
`on_behalf_of`	Optional. The Partner Account the user represents. Defaults to `account_id`.
`roles`	Required. The roles to assign for the Partner Account.
`deeplink_session_token`	Optional. Forward the token Klarna adds to your Klarna Access Provision URL (used by Entry Point 2).

See the full JWT parameter documentation here API

Entry Point 1: From Acquiring Partner Portal

This entry point allows Partners to access Klarna Partner Portal directly from your Partner-facing admin portal.

How it works

1.
Partner clicks a button/link in your portal
2.
Your system generates a signed JWT with the Partner's information
3.
Your system calls the deep link API with the JWT
4.
Your system redirects the Partner to the URL returned by the API
5.
Partner accesses Klarna Partner Portal without password setup

Creating a deep link

Use the createDeepLink API

operation to grant a user access to a Partner Account. It grants access to the single Partner Account identified by the {partner_account_id} path parameter, using the JWT you built above.

POST /accounts/{partner_account_id}/portal/deep-links

This endpoint accepts either a signed JWT (recommended) or an unsigned JSON body, and produces a one-time link that expires in 60 seconds.

On success, the endpoint responds with 200 OK, returning a JSON payload that includes a deep_link_id and a url property to use as the deep link.

Important characteristics:

One-time use: Each deep link can only be used once
Expires in 60 seconds: Request a new link if not used immediately
Session timeout: The session automatically stops after 8 hours of inactivity.

Only request deep links when the Partner explicitly wants to enter Klarna Partner Portal. Deep links may only be generated for accounts onboarded via your services.

Request payload:

JSON

1 2 3

{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<....>SMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

If you can't sign a JWT, send the same details in an unsigned body instead:

JSON

1 2 3 4 5

{
  "subject": "john.doe@example.com",
  "roles": ["merchant:admin"],
  "on_behalf_of": "krn:partner:global:account:live:LYABCDEI"
}

Sample 200 OK response:

JSON

1 2 3 4

{
  "deep_link_id": "krn:partner:global:account:live:LYABCDEI:deep-link:8f3c",
  "url": "https://auth.eu.portal.klarna.com/..."
}

sequenceDiagram participant A as User participant B as Acquiring Partner participant C as Management API participant D as Klarna Portal A->>B: User clicks "Go to Klarna" B->>C: Creates short lived deep link URL alt Signed request (JWT) - Klarna requires 2FA only for the user to log in Note over B,C: POST /accounts/{partner_account_id}/portal/deep-links <<Signed JSON Web Token (JWT)>> else Unsigned request - Klarna requires both password and 2FA to log in note over B,C: POST /accounts/{partner_account_id}/portal/deep-links { "subject": "john.doe@example.com", "roles": ["merchant:admin"] } end B-->>C: 200 note over B,C: { "deep_link_id": "krn:...", "url": "https://auth.eu.portal.klarna.com/..." } B-->>A: 200 note over A,B: { "url": "https://auth.eu.portal.klarna.com/..." } A->>D: User is redirected to the Klarna Portal

Revoking a deep link session

Deep link access can be revoked at any time between its creation and session expiration (8 hours after generation).

When to revoke

Unused links: Revoke a deep link if it will not be used
Security concerns: Revoke access to stop a user's ability to access Klarna Partner Portal

How to revoke

Make a DELETE request using the deleteDeepLink API

operation:

DELETE /accounts/{partner_account_id}/portal/deep-links/{deep_link_id}

{partner_account_id}: The Partner Account the deep link was created for
{deep_link_id}: The unique identifier received when creating the deep link

On success, the endpoint responds with 204 No Content.

When a deep link is revoked, the user will lose access to the Partner Account after, at most, 5 minutes.

This entry point displays a "Continue with [Acquiring Partner]" button on Klarna Partner Portal's home screen. When Partners click this button, they are redirected to your authentication system.

How it works

1.
Partner visits Klarna Partner Portal login page
2.
Partner clicks "Continue with [Acquiring Partner]" button
3.
Klarna redirects Partner to your Klarna Access Provision URL with a deeplink_session_token
4.
Your system authenticates the Partner (if not already logged in)
5.
Your system generates a signed JWT and calls the deep link API, including the deeplink_session_token
6.
Your system redirects the Partner to Klarna Partner Portal using the URL from the deep link API response

Step 1: Create the Klarna Access Provision URL

Create a publicly accessible URL where Partners can authenticate and receive Klarna Partner Portal access. This URL should:

Prompt Partners to login if not already authenticated
Leverage your existing identity and access management solutions
Handle the deeplink_session_token query parameter added by Klarna

Sample URL format:

HTTP

https://partner.example.com/login?source=klarna&deeplink_session_token=eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzNTQ2N2RlZi1iYzRj

Provide this URL to your designated Klarna technical point of contact. Klarna will configure it in the "Continue with [Acquiring Partner]" button.

Step 2: Provide access via the deep link API

Upon successful authentication:

Extract the deeplink_session_token from the query parameters
Generate your signed JWT (same process as Entry Point 1)
Call the createDeepLink operation with the JWT, including the deeplink_session_token from Klarna
Redirect the Partner to the URL returned by the deep link API

sequenceDiagram participant A as User participant B as Klarna Portal participant C as Acquiring Partner Portal participant D as Management API A->>B: User clicks "Continue with Acquiring Partner" button B->>A: Redirect to AP's Klarna Access Provision URL with {deeplink_session_token} A->>C: Load Klarna Access Provision URL opt If the user is not already authenticated with the Acquiring Partner system A->>C: Enter credentials C->>C: Authenticates end C->>D: Creates short lived deep link URL alt Signed request (JWT) - Klarna requires 2FA only for the user to log in Note over C,D: POST /accounts/{partner_account_id}/portal/deep-links <<Signed JSON Web Token (JWT)>> else Unsigned request - Klarna requires both password and 2FA to log in note over C,D: POST /accounts/{partner_account_id}/portal/deep-links { "subject": "john.doe@example.com", "roles": ["merchant:admin"], "deeplink_session_token": "<<deeplink_session_token>>" } end D-->>C: 200 note over C,D: { "url": "https://auth.eu.portal.klarna.com/..." } C-->>A: 200 note over A,C: { "url": "https://auth.eu.portal.klarna.com/..." } A->>B: User is redirected to the Klarna Portal

Following these steps will enable the "Continue with [Acquiring Partner]" button on Klarna Partner Portal's login screen and ensure a secure and streamlined login experience for Partners.

Unsigned deep linking (not recommended)

If you cannot implement signed JWT deep linking due to technical constraints, unsigned deep linking is available as a fallback.

Not recommended: This approach requires users to set up a password when accessing Klarna Partner Portal, adding an additional step that degrades user experience. Only use this if signed deep linking cannot be implemented.

With unsigned deep linking:

You call the deep link API without providing a JWT
You provide the user's email address (subject), the roles, and optionally the on_behalf_of directly
MFA is enforced within Klarna Partner Portal (instead of your portal)
Users must set up a password on first access

For unsigned deep linking parameters, see createDeepLink API

Multi-account deep links (future release)

These multi-account deep link endpoints aren't available yet. The multi-account deep link flow described below relies on the createPortalDeepLink API

and deletePortalDeepLink API

operations, which are planned for a future release. They are not callable in the test environment or in production today. Continue to use the account-scoped createDeepLink and deleteDeepLink operations documented above for all live integrations.

When this flow becomes available, the Create a deep link endpoint (createPortalDeepLink API

) will let you grant a user access to one or more Partner Accounts in a single request through an accesses array, with an optional access policy per Partner Account.

POST /portal/deep-links

Unlike the account-scoped endpoint, this operation has no Partner Account in the path. On success, it responds with 201 Created, returning a JSON payload that includes a deep_link_id and a url property.

The multi-account flow uses a JWT with payload version: 2. Grant access through the accesses array (1–100 entries) and set a single top-level on_behalf_of for the whole request.

Claim	Description
`version`	Required. Payload version. Set to `2`.
`on_behalf_of`	Required. The Partner Account the user represents in Klarna Partner Portal. For a Partner accessing its own account, use that same Partner Account ID. When you act as an Acquiring Partner on behalf of the Partner Accounts you manage, use your own Partner Account ID.
`accesses`	Required. List of access entries (1–100) to grant in a single request.
`accesses[].partner_account_id`	Required. The Partner Account the user gets access to.
`accesses[].roles`	Required. The roles to assign for that Partner Account.
`accesses[].access_policy_id`	Optional. An access policy that narrows which Payment Accounts the user can see within that Partner Account. It must belong to that entry's `partner_account_id`. Access policy is all-or-none across entries: either every entry sets one or none of them does.
`accesses[].expires_at`	Optional. The date the access expires, in `YYYY-MM-DD` format.
`accesses[].inactivity_grace_period`	Optional. The period of inactivity after which access is removed, as an ISO-8601 duration.

Creating a multi-account deep link

Build a version: 2 JWT payload and pass it to the Create a deep link endpoint:

JSON

1 2 3 4 5 6 7 8 9 10

{
  "version": 2,
  "iss": "krn:partner:global:account:live:LYABCDEI",
  "jti": "a4728c02-9885-41bf-b539-251ffa7f7eaa",
  "sub": "portal.user@merchant.com",
  "iat": 1716768000,
  "exp": 1716768060,
  "amr": ["pwd"],
  "on_behalf_of": "krn:partner:global:account:live:LYABCDEI",
  "accesses": [

Sample 201 Created response:

JSON

1 2 3 4

{
  "deep_link_id": "krn:partner:global:account:live:LYABCDEI:deep-link:8f3c",
  "url": "https://auth.eu.portal.klarna.com/..."
}

Revoking a multi-account deep link

Make a DELETE request using the deletePortalDeepLink API

endpoint:

DELETE /portal/deep-links/{deep_link_id}

{deep_link_id}: The unique identifier received when creating the deep link

On success, the endpoint responds with 204 No Content.

Klarna Partner Portal Overview

How to position Klarna to your Partners

API & SDK references

Create account deep link

Create deep link

Delete deep link

Grant access via Deep Link

Overview

The two entry points

Prerequisites

Implementation steps

Build and sign your JWT

Payload structure

Entry Point 1: From Acquiring Partner Portal

How it works

Creating a deep link

Revoking a deep link session

When to revoke

How to revoke

Entry Point 2: From Klarna login Portal

How it works

Step 1: Create the Klarna Access Provision URL

Step 2: Provide access via the deep link API

Unsigned deep linking (not recommended)

Multi-account deep links (future release)

Creating a multi-account deep link

Revoking a multi-account deep link