Grant access via Alternative methods

Explore alternative methods for granting Partners access to Klarna Partner Portal when the recommended Deep Link + AP Button approach cannot be implemented due to technical or business constraints.

8 min read

Overview

When the recommended Deep Link + AP Button approach cannot be implemented, Klarna supports two alternative methods:

Method	Description	When to use
User Access Management API	API-based access for creating and managing semi-permanent user accounts in Klarna Partner Portal. Users receive invitation emails and set up their own passwords.	For Acquiring Partners without an admin portal or when Partners need to request access through a manual process.
Identity Provider (IdP) via SAML	Delegates authentication to your system using SAML v2.0 protocol. You become the Identity Provider, and Klarna acts as the Service Provider.	For Acquiring Partners with advanced technical capabilities to implement SAML IdP, providing seamless single sign-on experience.

Recommended for integration

These methods are alternatives to the recommended approach. They may require additional technical implementation or result in less seamless user experience. Discuss with your Klarna representative before choosing an alternative method.

User Access Management API

Klarna Partner Portal accounts can be created via createUserAccess API

endpoint.

When to use this method

Use the User Access Management API when:

You don't have a Partner-facing admin portal
Partners need to manually request access (e.g., via support ticket)
You want to manage Partner users programmatically
Long-term access without frequent re-authentication is preferred

How it works

1.
User requests Access: Partners request access through your defined process (e.g., support ticket, self-service form)
2.
Integration: Your system calls the User Access Management API to create access
3.
Email invitation: Klarna sends an invitation email to the Partner
4.
Partner activation: Partner follows the activation flow (accept T&Cs, set up password and 2FA)

Implementation steps

Integration requirement

Important: This method requires JWT signing with a client certificate. If you haven't completed the JWT setup yet, follow the JWT signing setup.

Build and sign your JWT

After completing the JWT signing setup, create your JWT with the following structure:

Sample header

JSON

1 2 3 4 5 6

{
  "alg": "ES256",
  "typ": "JWT",
  "x5c": ["<your_cert_base64>"]
}

Sample payload

JSON

1 2 3 4 5 6 7 8 9 10

{
  "iss": "krn:partner:global:account:live:LYABCDEI",
  "jti": "a4728c02-9885-41bf-b539-251ffa7f7eaa",
  "sub": "portal.user@merchant.com",
  "iat": 1716768000,
  "exp": 1716768060,
  "version": 2,
  "on_behalf_of": "krn:partner:global:account:test:MB6KIE1P",
  "accesses": [
    {

User access JWT omits AMR

Note: Unlike deep linking, the User Access Management API JWT does not require the amr field.

Payload structure

The JWT uses payload version: 2. Grant access through the accesses array (up to 100 entries) and set a single top-level on_behalf_of for the whole request.

Claim	Description
`version`	Required. Payload version. Set to `2`.
`on_behalf_of`	Required. The Partner Account the user represents in Klarna Partner Portal. For a Partner accessing its own account, use that same Partner Account ID. When you act as an Acquiring Partner on behalf of the Partner Accounts you manage, use your own Partner Account ID.
`accesses`	Required. List of access entries (1–100) to grant in a single request.
`accesses[].partner_account_id`	Required. The Partner Account the user gets access to.
`accesses[].roles`	Required. The roles to assign for that Partner Account.
`accesses[].access_policy_id`	Optional. An access policy that narrows which Payment Accounts the user can see within that Partner Account. It must belong to the entry's `partner_account_id`.

Granting access to multiple accounts

Granting access to multiple Partner Accounts: Add one entry to accesses per Partner Account to grant a user access to several Partner Accounts in a single request. Use access_policy_id on an entry to restrict visibility to a subset of that Partner Account's Payment Accounts; an access policy can only narrow access, never widen it.

Optional JWT claims

Each entry in the accesses array can include optional claims to control access duration:

Claim	Description	Format	Example
`expires_at`	The date when the user's access expires. Must be a future date.	YYYY-MM-DD	`2026-12-31`
`inactivity_grace_period`	How long the access remains valid after user inactivity. Must be between 1 day and 6 months.	ISO 8601 duration	`P30D` (30 days) or `P3M` (3 months)

See the full JWT parameter documentation here API

Create user access

User access for Partners is created using a POST request to createUserAccess API

endpoint.

Request payload:

JSON

1 2 3 4

{
  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<....>SMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
}

On success, the endpoint responds with 204 No Content and dispatches an invitation email to the specified address. If that address is already registered, no new email will be sent.

You can define the level of access granted to the user by setting the roles array within each entry of the accesses array in the JWT payload.

What happens next:

1.
Klarna creates a Portal user for the supplied email (sub in JWT)
2.
Klarna gives the user access to each Partner Account listed in accesses
3.
Klarna sends an invitation email containing an activation link
4.
User follows the activation flow:
- 4.1.
  Accept Terms & Conditions
- 4.2.
  Update their given name and family name
- 4.3.
  Set up password
- 4.4.
  Configure two-factor authentication (2FA)

Deleting user access

User access can be deleted at any time. Make a DELETE request to deleteUserAccess API

endpoint, with optional query parameters:

Parameter	Description
`account_id`	The Partner Account ID of the access to delete
`on_behalf_of`	When specified, only the specific access with this `on_behalf_of` value will be deleted
`principal`	The ID or email of the user to delete the access from

Integration requirement

Warning: If no parameters are supplied, all user access created by you will be deleted.

If both account_id and principal parameters are provided, they are combined to precisely target and delete the user's access to the specified Partner account.

Deleting a user's access always removes all of the user's access along with all associated access policies. Deletion cannot be scoped to individual access policies.

Access revocation takes up to five minutes

When user access is revoked, the user's access to the Partner account will be removed within 5 minutes.

Acquiring Partner as Identity Provider (IdP)

An Identity Provider (IdP) is a system that authenticates users and authorizes their access to applications and services. In this setup, you act as the IdP and Klarna acts as the Service Provider (SP).

Benefits of IdP integration

By leveraging SAML v2.0, this setup ensures:

Secure Authentication: User credentials remain securely managed by your IdP
Policy Enforcement: Enables your security policies such as MFA
Enhanced Efficiency and Compliance: Centralized user management
Seamless SSO: Partners authenticate once and access multiple services

Prerequisites

Before implementing IdP integration, ensure you have:

SAML 2.0 IdP infrastructure in place
Ability to generate and sign SAML assertions
Certificate management capabilities
User attribute mapping configuration

Implementation steps

Provide Klarna with the required SAML configuration details:

IdP metadata XML or equivalent configuration
X.509 certificate for signing SAML assertions
IdP entity ID
Single Sign-On (SSO) endpoint URL
Single Logout (SLO) endpoint URL (if supported)

Klarna will complete the necessary configuration to accept SAML assertions from your IdP.

Step 2: Set up Klarna Partner Portal as the Service Provider

Configure Klarna Partner Portal to accept SAML assertions from your IdP
Enforce MFA during SAML authentication for enhanced security
Configure assertion consumer service (ACS) URL provided by Klarna
Set appropriate SAML binding (HTTP-POST recommended)

Step 3: Map user attributes

Define and map user attributes from your IdP to the corresponding Klarna Partner Portal users. Required attributes include:

Attribute	Description	Required
`email`	User's email address (used as unique identifier)	Yes
`account_id`	Partner Account ID in Klarna (e.g., `krn:partner:global:account:test:MB6KIE1P`)	Yes
`roles`	Array of role identifiers (e.g., `merchant:admin`)	Yes
`given_name`	User's first name	Optional
`family_name`	User's last name	Optional

Step 4: Handle SAML authentication requests

When Partners attempt to access Klarna Partner Portal:

1.
Klarna sends a SAML authentication request to your IdP
2.
Your IdP authenticates the user according to your policies
3.
Your IdP generates a SAML assertion with user attributes
4.
Your IdP signs the assertion and sends the SAML response to Klarna
5.
Klarna validates the assertion and grants access

Step 5: Testing

Before going live, test the complete SAML flow:

1.
Initiate authentication from Klarna Partner Portal
2.
Verify authentication redirects to your IdP
3.
Complete authentication at your IdP
4.
Verify successful redirect back to Klarna Partner Portal
5.
Confirm appropriate access based on roles

Coming soon

The SAML IdP solution requires coordination with Klarna for configuration. If you are interested in proceeding with this option for Klarna Partner Portal access, please reach out to your Klarna representative to discuss further.

Grant access via Deep Link

Klarna Partner Portal Overview

API & SDK references