Implement the recommended access solution featuring two entry points: deep linking from your portal and an AP button on Klarna's login page. This complete package provides secure, passwordless access with the best user experience.
Overview
The recommended approach for granting access to Klarna Partner Portal combines two entry points that work together as a complete solution:
The two entry points
| Entry Point | Description | Use Case |
|---|---|---|
| From Acquiring Portal | A button or link in your Partner-facing admin portal that uses the Deep Link API to provision access and redirect Partners directly to Klarna Portal. | Partners already logged into your portal who want to access Klarna features. |
| From Klarna Portal login | A button on Klarna Portal's login page that redirects Partners to your authentication system, then provisions access via Deep Link API. | Partners starting their journey from Klarna Portal or bookmarking Klarna Portal directly. |
Both entry points use the same Deep Link API and JWT signing mechanism. You only need to implement the JWT generation once to enable both entry points.
Prerequisites
Before implementing this solution, ensure you have completed the common prerequisites.
Additionally, you will need:
- Public-facing URL (for Klarna Portal login) where Partners can authenticate
Important: This method requires JWT signing with a client certificate. If you haven't completed the JWT setup yet, follow the JWT signing setup in the Overview page first.
Implementation steps
Follow these steps to implement both entry points:
Build and sign your JWT
After completing the JWT signing setup, create your JWT with the following structure:
Sample header
{
"alg": "ES256",
"typ": "JWT",
"x5c": ["<your_cert_base64>"]
}
Sample payload
{
"amr": ["pwd"],
"iss": "krn:partner:global:account:live:LYABCDEI",
"jti": "a4728c02-9885-41bf-b539-251ffa7f7eaa",
"sub": "portal.user@merchant.com",
"iat": 1716768000,
"exp": 1716892720,
"account_id": "krn:partner:global:account:test:MB6KIE1P",
"on_behalf_of": "krn:partner:global:account:test:MB6KIE1P",
"roles": ["merchant:admin"]
}
Note: The amr (authentication methods reference) field is required for deep linking. Use ["pwd"] to indicate password authentication is implemented on your side.
See the full JWT parameter documentation here
Entry Point 1: From Acquiring Partner Portal
This entry point allows Partners to access Klarna Portal directly from your Partner-facing admin portal.
How it works
- Partner clicks a button/link in your portal
- Your system generates a signed JWT with the Partner's information
- Your system calls the Deep Link API with the JWT
- Your system redirects the Partner to the URL returned by the API
- Partner accesses Klarna Portal without password setup
Creating a deep link
Deep links are created using a POST request to createDeepLink
Request payload:
{
"jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<....>SMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}
On success, the endpoint responds with 200 OK, returning a JSON payload that includes a url property to use as the deep link.
Important characteristics:
- One-time use: Each deep link can only be used once
- Expires in 60 seconds: Request a new link if not used immediately
- Session timeout: The session is automatically terminated after 8 hours of inactivity.
Only request deep links when the Partner explicitly wants to enter Klarna Portal. Deep links may only be generated for accounts onboarded via your services.
Revoking a deep link session
Deep link access can be revoked at any time between its creation and session expiration (8 hours after generation).
When to revoke
- Unused Links: Revoke a deep link if it will not be utilized
- Security Concerns: Revoke access to terminate a user's ability to access Klarna Portal
How to revoke
Make a DELETE request using deleteDeepLink
{partner_account_id}: The Partner Account ID for which the deep link was created{deep_link_id}: The unique identifier received when creating the deep link
When a deep link is revoked, the user will lose access to the Partner Account after, at most, 5 minutes.
Entry Point 2: From Klarna login Portal
This entry point displays a "Continue with [Acquiring Partner]" button on Klarna Portal's home screen. When Partners click this button, they are redirected to your authentication system.
How it works
- Partner visits Klarna Portal login page
- Partner clicks "Continue with [Acquiring Partner]" button
- Klarna redirects Partner to your Klarna Access Provision URL with a
deeplink_session_token - Your system authenticates the Partner (if not already logged in)
- Your system generates a signed JWT and calls the Deep Link API, including the
deeplink_session_token - Your system redirects the Partner to Klarna Portal using the URL from the Deep Link API response
Step 1: Create the Klarna Access Provision URL
Create a publicly accessible URL where Partners can authenticate and receive Klarna Portal access. This URL should:
- Prompt Partners to login if not already authenticated
- Leverage your existing identity and access management solutions
- Handle the
deeplink_session_tokenquery parameter added by Klarna
Sample URL format:
https://partner.example.com/login?source=klarna&deeplink_session_token=eyJhbGciOiJIUzUxMiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIzNTQ2N2RlZi1iYzRj
Provide this URL to your designated Klarna technical point of contact. Klarna will configure it in the "Continue with [Acquiring Partner]" button.
Step 2: Provide access via Deep Link API
Upon successful authentication:
- Extract the
deeplink_session_tokenfrom the query parameters - Generate your signed JWT (same process as Entry Point 1)
- Call the createDeepLink
deeplink_session_tokenfrom Klarna - Redirect the Partner to the URL returned by the Deep Link API
Following these steps will enable the "Continue with [Acquiring Partner]" button on Klarna Portal's login screen and ensure a secure and streamlined login experience for Partners.
Unsigned deep linking (not recommended)
If you cannot implement signed JWT deep linking due to technical constraints, unsigned deep linking is available as a fallback.
Not Recommended: This approach requires users to set up a password when accessing Klarna Portal, adding an additional step that degrades user experience. Only use this if signed deep linking cannot be implemented.
With unsigned deep linking:
- You call the Deep Link API without providing a JWT
- You provide the user's email address and other parameters directly
- MFA is enforced within Klarna Portal (instead of your portal)
- Users must set up a password on first access
For unsigned deep linking parameters, see createDeepLink