Yoursafe

Agents

Implement YOU Account Linking

Raw skill file

Linkage connects a creator's Yoursafe account to your platform. You send the creator to Yoursafe, then you receive publicToken, email, and iban tied to your pairingReference. Pay that token later with Mass Payments. If this skill and a product page disagree, follow the product page.

Read first

  1. YOU Account Linking — journey, both start URLs, signature, success redirect, postback
  2. Mass Payments when you pay the token

Implement in this order

  1. In Yoursafe Business, under YOU Account Linking, set the success redirect URL, the success postback URL, and the platform return URL. Copy the linkage ID and secret key.
  2. Send an existing account holder to GET https://you.yoursafe.com/pairaccount.
  3. Send a new account holder to GET https://you.yoursafe.com/pairaccount/register.
  4. Sign the request with pairingReference and platformConnectId.
  5. On the success redirect and on the postback, verify the signature, then store publicToken, email, and iban against pairingReference.
  6. A cancel returns the creator to the platform return URL with no parameters. Leave that user unlinked.

Credentials

  • YOU Account Linking ID (platformConnectId) and secret key from Yoursafe Business.
  • The secret stays on the server. Build the signature there.

Traps

  • This signature is hex SHA-1. FlexPay's SHA-256 does not verify these calls. Start with the secret key, then parameters in alphabetical order by name, as :name=value, encoded as UTF-8. Include an optional parameter only when it has a value.
  • When you verify a redirect or postback, sign every returned parameter except signature.
  • The browser redirect and the postback both carry the account. Verify the signature on each before you store the token.
  • pairingReference is 1–100 characters and only letters, digits, underscore, or hyphen. It is how you match the link to your user.
  • publicToken is 8 characters, A-Z and 0-9. Mass Payments pays that token. Keep the IBAN with your records of the link.

Done when

A successful link stores a signature-checked publicToken for the pairingReference you sent, and a cancel leaves that user unlinked.