SafeToken Project
Customer-facing integration engineering for a payment-authentication platform used by banks, fintechs, card issuers, and payment gateways.
Overview
SafeToken supports three authentication methods: service-issued OTPs delivered by SMS or email, authenticator-app TOTP credentials provisioned through QR codes, and counter-based OTPs generated by physical hard-token devices.
Customer and transaction flow
- Banks, fintechs, and card issuers enrol card tokens individually or through bulk uploads
- A payment gateway initiates validation for a cardholder transaction
- SafeToken generates an OTP and delivers it through an internal or configured third-party provider
- The gateway submits the cardholder's OTP to SafeToken for authentication
- The authenticated transaction proceeds to the issuing bank for authorization
My role
As a technical integration engineer, I supported external partners integrating token enrolment, OTP validation, delivery, and authentication flows. I investigated technical issues across partner requests, SafeToken services, and configured providers, then engaged the required product, engineering, and operational stakeholders to implement fixes and reach a production resolution.
Main capabilities
- Token registration, activation, update, and retrieval
- OTP generation, validation, and authentication
- Authenticator-app provisioning through QR codes
- Requestor and aggregator authorization
- SMS and email OTP delivery
- Configurable external OTP providers including GTB, ZIB, Rolez, and generic third parties
- Multiple regional SMS providers plus delivery reports and callbacks
- Validation history, correlation IDs, Wibmo reporting, and legacy token compatibility
Architecture and technology
- Java 25 and Spring Boot 4 REST application
- Controllers for external APIs and services for token and authentication rules
- Provider abstractions for external OTP, SMS, and email systems
- JDBC DAOs backed by Microsoft SQL Server
- Redis for temporary OTP and request-session data
- Kafka for asynchronous validation reports
- Flyway and an internal migrator for database changes
- HSM integration for cryptographic authentication-token generation
- OpenAPI/Swagger, Actuator, structured logging, and Docker deployment
Why it matters
The platform sits in a security-sensitive part of the payments stack, so correctness, traceability, delivery reliability, and partner integration behavior all matter at the same time.