OAuth2
We follow the standard Authorization Code grant flow from OAuth2 to authenticate a TPP acting on behalf of a PSU.
As an example, in production our URLs are:
- Authorization URL: https://client.memo.bank/authorize
- Token URL: https://api.memo.bank/nextgenpsd2/oauth2/token
- Refresh URL: https://api.memo.bank/nextgenpsd2/oauth2/token
The access_token
has a TTL of 2 hours and the refresh_token
has a TTL of 2 weeks.
HTTP Signature
Requests must be signed by TPPs using the private key associated to the certificate provided during the onboarding process.
We follow the draft-cavage-http-signatures-12 to authenticate a TPP.
They keyId
shall be formatted as follows: keyId="SN=XXX,CA=YYYYYYYYYYYYYYYY"
, where XXX
is the serial number of the certificate in hexadecimal coding and YYYYYYYYYYYYYYYY
is the full Distinguished Name of the Certification Authority encoded following RFC1779.
Here is an exhaustive list of headers that must be signed:
(request-target)
(mandatory)authorization
(mandatory)date
(mandatory)digest
(only if the request has a body)host
(mandatory)psu-corporate-id
(only if included in the request)psu-id
(only if included in the request)tpp-redirect-uri
(only if included in the request)x-request-id
(only if included in the request)