Executive Direct Answer: Integrating with Newline™ by Fifth Third Bank via API requires a two-step authentication handshake: signing a JWT refresh token with a shared HMAC key using HS512 encryption (sub program UID and current Epoch iat timestamp), posting to /api/v1/auth with a unique x-trace-id header, and using the returned bearer token to query banking resources like /api/v1/transactions within an 8-hour window.

Overview: Embedded Payments via Newline by Fifth Third Bank

Newline™ by Fifth Third Bank is a modern, composable embedded payments platform built to provide software platforms, fintechs, and enterprise businesses with direct access to commercial banking infrastructure without unnecessary intermediary software layers. With Newline, organizations can embed payment initiation, card issuance, and account management directly into their custom software or ERP systems like Microsoft Dynamics 365.

The platform delivers three core capabilities:

  • Payments and Transfers: Initiate ACH payments, domestic wires, internal book transfers, and Real-Time Payments (RTP) through a single unified REST API.
  • Commercial Card Issuance: Issue commercial credit or prepaid debit cards instantly in both virtual and physical formats with programmatic spend controls.
  • Account Management: Maintain FDIC-insured bank accounts, including virtual reference numbers, custodial accounts, and automated ledger reconciliation.

Section 1: How the Newline by Fifth Third Bank API Works

The Newline API is engineered for seamless integration into enterprise C# backends, Azure Functions, and ERP integration middleware.

1.1 RESTful Architecture & Standards

  • RESTful Design: Organized around strict REST principles using clean, resource-oriented URLs.
  • JSON Payload Formats: Accepts JSON-encoded request bodies and returns structured JSON responses.
  • Standard HTTP Methods: Utilizes standard GET, POST, PUT, and DELETE operations.

1.2 Developer Resources & Sandbox Environments

Developers can request API credentials and test transactions in the official Newline Sandbox environment (https://sandbox.api.newline53.com). Detailed interactive guides and Postman collections are accessible via the official portal at newline53.com.

Section 2: Authentication & Access Token Generation Protocol

Security on the Newline platform relies on HMAC-signed JSON Web Signatures (JWS). Access tokens are valid for up to 8 hours once generated.

To request an access token, the client application generates a refresh token containing a JWT payload with two mandatory claims:

  1. sub (subject): Your assigned Program UID provided by Fifth Third Bank.
  2. iat (issued at timestamp): Current Epoch Unix timestamp (in seconds).

The token MUST be signed using HS512 (HMAC SHA-512) with the shared secret key provided during onboarding. When posting to POST /auth, Newline validates the timestamp, allowing a 30-second clock skew window to account for server drift.

Section 3: Testing Authentication in Postman

Before writing C# code, configure your Postman environment (Newline Sandbox):

  • program_uid: Set to your assigned Program UID.
  • hmac_key: Set to your shared secret key.
  • base_url: https://sandbox.api.newline53.com
  • x-trace-id: Dynamically generated GUID using {{$guid}}.

Section 4: C# Implementation — Generating Access Tokens

Below is the production-ready C# code using HttpClient, Microsoft.IdentityModel.Tokens, and System.IdentityModel.Tokens.Jwt to sign the refresh token and request a Bearer token:

CSHARP
using System;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Threading.Tasks;
using Newtonsoft.Json;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

namespace NewlineIntegration
{
    class Program
    {
        private const string AuthUrl = "https://sandbox.api.newline53.com/api/v1/auth";
        private const string HmacKey = "YOUR_HMAC_KEY_HERE"; // Provided by Bank
        private const string ProgramUid = "YOUR_PROGRAM_UID";  // Provided by Bank

        static async Task Main(string[] args)
        {
            string token = GenerateJwtToken(HmacKey, ProgramUid);
            using (HttpClient client = new HttpClient())
            {
                string authTraceId = Guid.NewGuid().ToString();
                client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                client.DefaultRequestHeaders.Add("Authorization", token);
                client.DefaultRequestHeaders.Add("x-trace-id", authTraceId);

                var requestData = new { };
                string json = JsonConvert.SerializeObject(requestData);
                HttpContent content = new StringContent(json, Encoding.UTF8, "application/json");

                HttpResponseMessage authResponse = await client.PostAsync(AuthUrl, content);
                string authResponseString = await authResponse.Content.ReadAsStringAsync();
                Console.WriteLine("Auth Response: " + authResponseString);

                var authResponseData = JsonConvert.DeserializeObject<dynamic>(authResponseString);
                string accessToken = authResponseData?.token;

                if (accessToken == null)
                {
                    Console.WriteLine("Failed to retrieve access token.");
                    return;
                }
                Console.WriteLine("Successfully obtained Access Token!");
            }
        }

        private static string GenerateJwtToken(string hmacKey, string programUid)
        {
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(hmacKey));
            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha512);
            var header = new JwtHeader(credentials);
            var payload = new JwtPayload
            {
                { "sub", programUid },
                { "iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds() }
            };

            var secToken = new JwtSecurityToken(header, payload);
            var handler = new JwtSecurityTokenHandler();
            return handler.WriteToken(secToken);
        }
    }
}

4.1 Authentication Response Payload (Output)

JSON
{
  "token": "auth-eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJQcm9ncmFtX1VJRCIsImlhdCI6MTc0Mjg5NTcyOH0.signature_hash...",
  "token_type": "Bearer",
  "expires_in": 28800,
  "status": "SUCCESS"
}

Section 5: C# Implementation — Retrieving Bank Transactions

Once an access token is retrieved, your C# application can query account transactions from the /api/v1/transactions endpoint by attaching the Bearer token and a fresh x-trace-id:

CSHARP
using System;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Text;
using System.Threading.Tasks;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

namespace NewlineIntegration
{
    class TransactionReader
    {
        private const string AuthUrl = "https://sandbox.api.newline53.com/api/v1/auth";
        private const string TransactionsUrl = "https://sandbox.api.newline53.com/api/v1/transactions";
        private const string HmacKey = "YOUR_HMAC_KEY_HERE";
        private const string ProgramUid = "YOUR_PROGRAM_UID";

        static async Task Main(string[] args)
        {
            using (HttpClient client = new HttpClient())
            {
                // Step 1: Authenticate and get Access Token
                string token = GenerateJwtToken(HmacKey, ProgramUid);
                client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                client.DefaultRequestHeaders.Add("Authorization", token);
                client.DefaultRequestHeaders.Add("x-trace-id", Guid.NewGuid().ToString());

                HttpResponseMessage authResponse = await client.PostAsync(AuthUrl, new StringContent("{}", Encoding.UTF8, "application/json"));
                string authResponseString = await authResponse.Content.ReadAsStringAsync();
                dynamic authResponseData = JsonConvert.DeserializeObject(authResponseString);
                string accessToken = authResponseData?.token;

                if (string.IsNullOrEmpty(accessToken))
                {
                    Console.WriteLine("Authentication failed.");
                    return;
                }

                // Step 2: Query Transactions
                await FetchTransactions(client, accessToken);
            }
        }

        private static async Task FetchTransactions(HttpClient client, string accessToken)
        {
            client.DefaultRequestHeaders.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            client.DefaultRequestHeaders.Add("Authorization", accessToken);
            client.DefaultRequestHeaders.Add("x-trace-id", Guid.NewGuid().ToString());

            HttpResponseMessage response = await client.GetAsync(TransactionsUrl);
            string jsonResponseString = await response.Content.ReadAsStringAsync();
            Console.WriteLine("Transactions Payload: " + jsonResponseString);

            JObject jsonResponse = JObject.Parse(jsonResponseString);
            JArray transactions = (JArray)jsonResponse["data"];
            Console.WriteLine(
quot;Retrieved {transactions?.Count ?? 0} transaction records.");
        }

        private static string GenerateJwtToken(string hmacKey, string programUid)
        {
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(hmacKey));
            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha512);
            return new JwtSecurityTokenHandler().WriteToken(new JwtSecurityToken(new JwtHeader(credentials), new JwtPayload
            {
                { "sub", programUid },
                { "iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds() }
            }));
        }
    }
}

5.1 Transactions API JSON Response Payload (Output)

JSON
{
  "data": [
    {
      "id": "txn_9876543210",
      "account_id": "acc_5th3rd_9912",
      "amount": 2500.00,
      "currency": "USD",
      "direction": "CREDIT",
      "payment_method": "ACH_CREDIT",
      "description": "Embedded Commercial Payment Disbursement",
      "trace_id": "b83f0a12-881a-4c2a-9e12-3210ab45cdef",
      "status": "SETTLED",
      "created_at": "2025-04-07T14:30:00Z"
    }
  ],
  "object": "list",
  "has_more": false
}

Section 6: Integration Architecture & Transaction Schema Matrix

API Parameter / HeaderData TypeRequiredDescription & Usage
Authorization (Auth Request)String (JWS)YesHS512 HMAC-signed token containing Program UID sub and iat Epoch timestamp.
Authorization (Data Requests)String (Bearer)YesAccess token returned by /api/v1/auth (valid for 8 hours).
x-trace-idString (GUID)YesUnique trace ID per request. Duplicates submitted within 7 days are rejected.
dataArray (JSON)ResponseCollection of transaction records containing amounts, counterparty info, and timestamps.
subString (Claim)YesProgram UID assigned by Fifth Third Bank in JWT payload.

Conclusion & Best Practices for ERP Banking Integration

Integrating Newline by Fifth Third Bank via C# allows growing software platforms and enterprise Microsoft Dynamics 365 environments to execute automated treasury reconciliations, ACH disbursements, and real-time bank feeds with programmatic reliability. By enforcing HMAC-SHA512 JWS signing and unique x-trace-id headers, financial transactions remain secure and audit-proof.

Frequently Asked Questions for Voice & AI Search

Q: How do you authenticate with Newline by Fifth Third Bank API?

A: Authentication requires generating a JWT token signed with HMAC SHA-512 (HS512) containing your Program UID as sub and current Epoch timestamp as iat, then sending it to POST /api/v1/auth with a unique x-trace-id.

Q: How long is a Newline API access token valid?

A: Access tokens returned by the Newline POST /api/v1/auth endpoint remain valid for up to 8 hours.

Q: What is the purpose of the x-trace-id header in Newline API requests?

A: The x-trace-id header requires a unique GUID for every request to enforce idempotency and prevent duplicate transaction processing. Re-using a trace ID within 7 days results in API rejection.

Q: Can Newline API integrate directly into Microsoft Dynamics 365 ERP?

A: Yes. Newline API can be connected to Dynamics 365 Finance & Operations or Business Central via C# Azure Functions or Azure Integration Services for automated bank feed reconciliation and payment initiation.