Klarna provides access to Booster features such as Express Checkout, On-site Messaging, and Sign in with Klarna, through the Klarna Portal. Access enables Partners to retrieve credentials and complete setup within Klarna’s ecosystem Acquiring Partners are required to grant access to the Klarna Portal to support these functionalities.

Key features of the Klarna Portal:

• Boost features access: Access to key conversion-enhancing features like Klarna Boost products is enabled through access to the portal.
• Credential Management: Partners are enabled to generate restricted credentials to supplement their Acquiring Partner integration.

Granting Portal Access

Access is managed through roles assigned collaboratively by Klarna and the Acquiring Partner. Multiple access methods are supported; however, the recommended approach must be leveraged wherever possible. Alternative solutions may be agreed upon with Klarna based on technical or business constraints.

The presentation of any link between your Partner-facing admin portal must be agreed and signed off in accordance with Klarna’s user experience guidelines. Details are available in Klarna’s user experience guidelines.

Deep linking facilitates seamless user access to Klarna’s Partner Portal via either a signed or unsigned method.

When the user clicks a link that should redirect to the Klarna Portal from the your portal, the acquiring partner should use the Deep link API and redirect the User to Klarna using the url from the response. You need to share the email address of the User that will then need to create or log-in their Klarna Portal Account.

By leveraging signed deep linking, the Acquiring Partner simplifies access to the Klarna Portal, avoiding password setup, supporting audit-ability of access, and ensuring non-repudiation. It can be enabled through the steps below:

• Step 1: Generate a key and a public certificate to sign the JWT.
  
  • To generate these, follow steps 2 to 4 listed here. When reaching out to Klarna to ask for the certificate, make sure to mention that the purpose of it is for JWT signing, not mTLS.
  
  • Use the private key generated in the previous step 2 to sign the JWT (it is an ECDSA key, so the ES256 algorithm must be used).
  
  • The public certificate provided by Klarna must be included in the “x5c” header of the JWT. (See here the official technical definition of this header and here an example of how it looks).
  
• Step 2: Generate a JWT containing the parameter listed here and a session token for redirection.
• Step 3: Use Klarna’s Deep Link API to generate a one-time URL.
• Step 4: Redirect the user to Klarna Portal using the URL.

Creating a deep link

Deep links for Partners are created using a POST request to /v2/accounts/{account_id}/portal/deep-links and are valid for one-time use, expiring after 60 seconds. Deep links should only be requested after the Partner expresses a desire to enter the Klarna Portal, and may only be generated for accounts onboarded via your services. The provisioned accesses remain valid until the user is logged out from Klarna.

You can define the level of access granted to the user by setting the roles array.

• merchant:admin - provides access allowing the Partner to access all apps defined within the Acquiring Partner agreement.
• merchant:developer - provides access only to those apps which will assist a developer in implementing Klarna. Allows for the creation of client-side tokens and implementation of Klarna Boost features.

The deep-link API returns a URL for redirecting the user to Klarna. Parameters vary based on the method used:

• Signed JWT - Definition 1, delegates authentication to the Acquiring Partner.
• Regular payload - Definition 2, requires the user to set a password.

Definition 1: Content of the JWT that will be signed

Definition 2: Content of an unsigned Payload - will require users to create their own password

Revoking a deep link

Deep link access can be revoked at any time between its creation and session expiration, which occurs 8 hours after the link is generated.

Recommendations for Revocation

• Unused Links: Revoke a deep link if it is known it will not be utilized.
• Security Concerns: Revoke access if there is a need to terminate a user’s ability to access the Klarna Partner Portal.

Deep links for Partners can be manually revoked using a DELETE request to /v2/accounts/{account_id}/portal/deep-links/{deep_link_id}

• {deep_link_id}: the unique identifier received when creating a deep-link.
• {account_id}: the account associated with the Partner.

An Identity Provider (IdP) is a system that authenticates users and authorizes their access to applications and services. In this setup, The Acquiring Partner acts as the IdP and Klarna acts as the Service Provider (SP).  By leveraging SAML v2.0, this setup ensures:

• Secure Authentication: User credentials remain securely managed by the IdP.
• Policy Enforcement: Enables security policies such as MFA.
• Enhanced Efficiency and Compliance: Centralized user management.

To enable Klarna Portal to leverage the Acquiring Partner as an IdP the following setup is required:

Step 1: Share SAML Configuration with Klarna

• Provide Klarna with the required SAML configuration details (e.g., metadata, certificates, endpoints).
• Klarna will complete the necessary configuration on their end.

Step 2: Set Up Klarna Portal as the Service Provider

• Configure Klarna Portal to accept SAML assertions from your IdP.
• Enforce MFA during SAML authentication for enhanced security.

Step 3: Map User Attributes

• Define and map user attributes from your IdP to the corresponding Klarna Portal users.
• Attributes may include partner account IDs, roles, and other relevant details.

Step 4: Handle SAML Authentication Requests

• Receive SAML authentication requests from Klarna.
• Process the requests in accordance with the SAML v2.0 protocol and return SAML authentication responses.

Step 5: Provision Access

• Use the Deep Link API or SAML Response to grant users access to the Klarna Portal.

Klarna Portal accounts can also be created via the user access management API. This API is similar to deep linking, except instead of giving a user temporary access to the portal via a link, this creates (semi-)permanent access.

Creating user access

User access for Partners are created using a POST request to /v2/portal/user-access.

You can define the level of access granted to the user by setting the roles array.

• merchant:admin - provides access allowing the Partner to access all apps defined within the Acquiring Partner agreement.
• merchant:developer - provides access only to those apps which will assist a developer in implementing Klarna. Allows for the creation of client-side tokens and implementation of Klarna Boost features.

We will create a Klarna Portal user for the supplied email (sub), give them access to the sub-account and send an invitation email to them, containing an activation link. The user will then need to follow the activation flow (accept T&Cs, update their given/family name, and set up their password and 2FA).

Definition 1: Content of the JWT that will be signed