When the recommended Deep Link + AP Button approach cannot be implemented, Klarna supports two alternative methods:

An Identity Provider (IdP) is a system that authenticates users and authorizes their access to applications and services. In this setup, you act as the IdP and Klarna acts as the Service Provider (SP).

By leveraging SAML v2.0, this setup ensures:

• Secure Authentication: User credentials remain securely managed by your IdP
• Policy Enforcement: Enables your security policies such as MFA
• Enhanced Efficiency and Compliance: Centralized user management
• Seamless SSO: Partners authenticate once and access multiple services

Before implementing IdP integration, ensure you have:

• SAML 2.0 IdP infrastructure in place
• Ability to generate and sign SAML assertions
• Certificate management capabilities
• User attribute mapping configuration

Step 1: Share SAML configuration with Klarna

Provide Klarna with the required SAML configuration details:

• IdP metadata XML or equivalent configuration
• X.509 certificate for signing SAML assertions
• IdP entity ID
• Single Sign-On (SSO) endpoint URL
• Single Logout (SLO) endpoint URL (if supported)

Klarna will complete the necessary configuration to accept SAML assertions from your IdP.

Step 2: Set up Klarna Portal as the Service Provider

• Configure Klarna Portal to accept SAML assertions from your IdP
• Enforce MFA during SAML authentication for enhanced security
• Configure assertion consumer service (ACS) URL provided by Klarna
• Set appropriate SAML binding (HTTP-POST recommended)

Step 3: Map user attributes

Define and map user attributes from your IdP to the corresponding Klarna Portal users. Required attributes include:

Step 4: Handle SAML authentication requests

When Partners attempt to access Klarna Portal:

1. Klarna sends a SAML authentication request to your IdP
2. Your IdP authenticates the user according to your policies
3. Your IdP generates a SAML assertion with user attributes
4. Your IdP signs the assertion and sends the SAML response to Klarna
5. Klarna validates the assertion and grants access

Step 5: Testing

Before going live, test the complete SAML flow:

1. Initiate authentication from Klarna Portal
2. Verify authentication redirects to your IdP
3. Complete authentication at your IdP
4. Verify successful redirect back to Klarna Portal
5. Confirm appropriate access based on roles

Klarna Portal accounts can be created via createUserAccess endpoint.

Use the User Access Management API when:

• You don't have a Partner-facing admin portal
• Partners need to manually request access (e.g., via support ticket)
• You want to manage Partner users programmatically
• Long-term access without frequent re-authentication is preferred

1. User requests Access: Partners request access through your defined process (e.g., support ticket, self-service form)
2. Integration: Your system calls the User Access Management API to create access
3. Email invitation: Klarna sends an invitation email to the Partner
4. Partner activation: Partner follows the activation flow (accept T&Cs, set up password and 2FA)

Build and sign your JWT

After completing the JWT signing setup, create your JWT with the following structure:

Sample header

{
  "alg": "ES256",
  "typ": "JWT",
  "x5c": ["<your_cert_base64>"]
}

Sample payload

{
  "iss": "krn:partner:global:account:live:LYABCDEI",
  "jti": "a4728c02-9885-41bf-b539-251ffa7f7eaa",
  "sub": "portal.user@merchant.com",
  "iat": 1716768000,
  "exp": 1716892720,
  "account_id": "krn:partner:global:account:test:MB6KIE1P",
  "on_behalf_of": "krn:partner:global:account:test:MB6KIE1P",
  "roles": ["merchant:admin"],
  "expires_at": "2024-12-31",
  "inactivity_grace_period": "P30D"
}

Optional JWT claims

In addition to the required claims shown above, you can include optional claims to control access duration:

See the full JWT parameter documentation here.

Create user access

User access for Partners is created using a POST request to createUserAccess endpoint.

Request payload:

{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<....>SMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

You can define the level of access granted to the user by setting the roles array in the JWT payload.

What happens next:

1. Klarna creates a Portal user for the supplied email (sub in JWT)
2. Klarna gives the user access to the specified account
3. Klarna sends an invitation email containing an activation link
4. User follows the activation flow:
   1. Accept Terms & Conditions
   2. Update their given name and family name
   3. Set up password
   4. Configure two-factor authentication (2FA)

User access can be deleted at any time. Make a DELETE request to deleteUserAccess endpoint, with optional query parameters:

If both account_id and principal parameters are provided, they are combined to precisely target and delete the user's access to the specified Partner account.