validate-iban-before-payment

Validate an IBAN before a payment

IBANforge checks the structure and the check digits of an IBAN and names the bank behind it, with its BIC and the source of that answer. Where it reads the national register, it also says whether the bank code is allocated at all. For a SEPA bank it resolves, it gives the SEPA schemes that reach it and whether the EPC Verification of Payee (VoP) register lists the bank as ready.

When to use it

• Before a payout, a refund or a supplier payment to an IBAN that has not been paid before.
• When a supplier, customer or employee record receives new bank details: a form, a CSV import, an ERP migration.
• When the code needs the bank name, the BIC or the SEPA reachability behind an IBAN.

Call the API from the server. Its CORS policy answers only IBANforge's own origins, so a browser on another site cannot read the response, and a key placed in browser code is public anyway.

1. Try it without a key (development)

curl -s -X POST https://api.ibanforge.com/v1/iban/validate \
  -H 'Content-Type: application/json' \
  -d '{"iban":"DE89370400440532013000"}'

The keyless trial serves 25 validations a week per source address (IPv6 counted per /64), on this route only. The week is the ISO week in UTC, reset on Monday 00:00 UTC. The answer carries a trial block with calls_left_this_week and resets_at.

The trial is for trying the API, not for production: every call from one server draws on the same address, and once it is spent the route answers 402 until the reset. Send a real IBAN: an empty {} body is the x402 discovery probe and always answers 402.

2. Production: a free API key

curl -s -X POST https://api.ibanforge.com/v1/keys/generate \
  -H 'Content-Type: application/json' \
  -d '{"source":"skill"}'

No e-mail and no card are needed. The api_key in the answer (ifk_ and 64 hexadecimal characters) is shown once: store it as a server-side secret. The source field only records where the key came from; the call works without a body.