> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Ontra with OAuth 2.0 – StackOne Hub

> Link a Ontra account in the StackOne Hub using OAuth 2.0. End-user guide to authorize the integration and start using Ontra actions.

<Warning>Ontra API access is not enabled by default — contact [api.support@ontra.ai](mailto:api.support@ontra.ai) to have it turned on for your account. Creating an API client requires Ontra admin privileges.</Warning>

<section data-guide-section data-guide-scopes="">
  <h2>Choose an environment</h2>

  <p>Ontra runs separate production and sandbox environments with separate API clients and credentials.</p>

  <Steps>
    <Step title="Select the environment to connect">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Pick the environment that matches the API client you are about to create.</p>

        <ul>
          <li>Choose <strong>Production</strong> for live fund and contract data — production always requires an mTLS certificate</li>
          <li>Choose <strong>Sandbox</strong> for development and testing — sandbox accepts either an mTLS certificate or a client secret</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Generate an mTLS certificate</h2>

  <p>Ontra authenticates API clients with a self-signed certificate that you generate yourself and keep.</p>

  <Steps>
    <Step title="Create the key pair">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Run `openssl req -x509 -newkey rsa:2048 -keyout private_key.pem -out public_cert.pem -days 365`, replacing `365` with how many days the certificate should stay valid. This writes two files into the current directory.</p>
      </div>
    </Step>

    <Step title="Keep the private key safe">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>`private_key.pem` is the secret half of the pair and is never sent to Ontra. Store it securely and do not share it.</p>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Create an Ontra API client</h2>

  <p>Register your public certificate with Ontra to receive a client ID.</p>

  <Steps>
    <Step title="Open the API clients page">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Log in to Ontra and navigate to <strong>Admin > Integrations > Ontra API > Manage</strong>.</p>
      </div>
    </Step>

    <Step title="Create the client">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Create a new API client and upload the `public_cert.pem` file you generated.</p>

        <ul>
          <li>Copy the <strong>Client ID</strong> that Ontra issues — you will need it below</li>
          <li>In the sandbox only, you may instead create a client that authenticates with a <strong>Client Secret</strong></li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Enter your credentials</h2>

  <p>Provide the client ID plus either the certificate pair or, in the sandbox, the client secret.</p>

  <Steps>
    <Step title="Client ID">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Paste the Client ID from the Ontra API clients page.</p>
      </div>
    </Step>

    <Step title="Certificate and private key">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Open `public_cert.pem` and `private_key.pem` in a text editor and paste the full contents of each, including the `-----BEGIN ...-----` and `-----END ...-----` marker lines.</p>
      </div>
    </Step>

    <Step title="Client Secret (sandbox only)">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>If you created a sandbox client that uses a client secret, paste it here and leave the certificate and private key blank.</p>
      </div>
    </Step>
  </Steps>
</section>

<div data-whitelabel-hide>
  <h2>Linking the Account from the Hub</h2>

  <Steps>
    <Step title="Navigate to the Hub">
      Use one of the three <a href="/connect/managing-connectors/linking-accounts">Linking Account Methods</a> to access the Hub.
    </Step>

    <Step title="Fill out the fields">
      Fill out the following fields using details from your provider:

      <ul>
        <li><strong>Client ID</strong></li>
        <li><strong>Certificate</strong> (Optional)</li>
        <li><strong>Private Key</strong> (Optional)</li>
        <li><strong>Client Secret</strong> (Optional)</li>
      </ul>
    </Step>

    <Step title="Connect">
      <ul>
        <li>Click <strong>Connect</strong></li>
        <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
        <li>Once authorization is successful, you will see a confirmation popup</li>
      </ul>
    </Step>
  </Steps>

  <p>If the account linking is successful, you will see the newly linked account in your <a href="/gateway/concepts/linked-accounts">Accounts</a> page.</p>
</div>