Overview

Every Allaria API — brokerage, wallet, onboarding, account opening — is reached through the same gateway and secured the same way.

This section is the entry point for any integration. It explains:

• how access is granted;
• how to obtain a token;
• which product section to read next.

Base URLhttps://b2b.allaria.dev

All the endpoints documented on this site hang off this base URL. There is one base URL per environment (development and production); the one shown above corresponds to the environment this site was built for.

How access works

Access is granted in three independent layers. All three must be in place before a request succeeds.

Layer	What it controls	How it is granted	Symptom when missing
Network	Which IP addresses may reach the gateway at all	Allaria whitelists your public egress IPs — see Access	The request times out with no HTTP status
Identity	Who you are	A client_id / client_secret pair issued to your company, exchanged for a token — see Authentication	401 invalid_client
Authorization	Which products and endpoints your credentials may use	Permissions attached to your client_id when your integration is set up	403 on an endpoint that otherwise works

A 403 on a single endpoint while the rest of your integration works means your credentials were not granted that product.

Request it at integraciones@allaria.com.ar — it is not something you can enable yourself.

Authentication model

Allaria uses the OAuth 2.0 client_credentials grant. This is a server-to-server flow: your backend authenticates as your company, not as an end user. There is no login screen, no redirect and no refresh token.

• Credentials are issued per company and per environment. Development credentials do not work in production.
• The token is a Bearer token, valid for 24 hours (expires_in: 86400).
• Request a new token when the current one expires — reusing an expired token returns 401.
• The client_secret must never leave your backend. See the security note in Authentication.

Getting started

1

Request credentials and whitelisting

Contact integraciones@allaria.com.ar with:

• your company details;
• the public IP addresses your integration will call from;
• the products you need to integrate.

You receive a client_id and client_secret per environment.

Details: Access.

2

Obtain an access token

Exchange your credentials for an access_token at POST /auth/token, then send it as Authorization: Bearer <access_token> on every subsequent request.

Details: Authentication.

3

Go to your product section

Which endpoints you call next depends on what your company does. See the table below.

New to the Argentine capital market, or unsure what a comitente, a CVU or MEP is? Start with the Glossary — it also has the table of which account identifier each endpoint family expects.

Which section applies to you

Your situation	Section	What we provide
You bring end customers to Allaria but your company is not an obliged entity (sujeto obligado), so you are not authorized to collect and transmit their personal data yourself	Onboarding	A complete onboarding — frontend and backend — together with the API to open the account. Allaria runs the identity verification and takes responsibility for the KYC.
Your company is an obliged entity and already performs its own customer due diligence	Account Opening	Allaria opens the accounts on the strength of your own verification, so no onboarding flow is needed.
You operate as an ALyC integration: orders, positions, movements, market data, MEP, mutual funds	Allaria	The brokerage API surface: orders, positions, movements, MEP, mutual funds, savings plans, market data.
You integrate the Allaria+ wallet: accounts, transfers, web checkout	Allaria+	The wallet API surface: accounts, transfers, web checkout.
You are a PSP and want your customers' balances to earn a return in an Allaria mutual fund	Allaria › Services for PSPs	An end-to-end flow: batch subscriptions and redemptions for the account range assigned to you, plus holdings, quotes and daily totals to reconcile.

Onboarding or Aperturas?

Both end with an open Allaria account, but they answer different regulatory positions — whether or not your company is an obliged entity before the UIF. The two paths are not interchangeable.

Unsure which one applies to your company? Ask integraciones@allaria.com.ar before you start building.