OAuth2 provides a standard way to authorize access to protected resources, and our API supports both the authorization code and client credentials grant types. Developers can use OAuth2 to obtain access tokens that are valid for a limited time and can be used to make authenticated API calls.
OAuth 2 is an authorization mechanism that gives you permission to a) Call LAFISE APIs and b) Access the end user’s data (given the user’s consent). This permission is encoded in an access token that you obtain through the OAuth operation "Authentication" that is described in this document. When you call a LAFISE API, you pass the access token to the Authorization header and the x-api-key in the request message, like this:
Authorization: Bearer
eyJraWQiOiJSSGVcL1VWS0RSWEpleWRXZkkrZWpKY1MyVnVwWTV6MmVtWEdnRUg4dkx1RT0iLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiI2dXBvZGhscG45YTQ4anVkc3JkcTExa2ZlbSIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiY2F0YWxvZ3NcL2dldF9jYXRhbG9nX2RldGFpbF9ieV9jYXRhbG9nX2lkIGNhdGFsb2dzXC9nZXRfY2F0YWxvZ19ieV9jYXRhbG9nX2lkIGt5Y1wvY3VzdG9tZXJfa3ljX2NoZWNrIGNhdGFsb2dzXC9nZXRfY2F0YWxvZ3MiLCJhdXRoX3RpbWUiOjE2NzcwMjIyNTQsImlzcyI6Imh0dHBzOlwvXC9jb2duaXRvLWlkcC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbVwvdXMtZWFzdC0xX0ZQb2lsRXRaSiIsImV4cCI6MTY3NzAyNTg1NCwiaWF0IjoxNjc3MDIyMjU0LCJ2ZXJzaW9uIjoyLCJqdGkiOiI4OWE2ODIwYy1iMWJhLTQ1YzUtYjA2Ny0yMGE1MmFjNWQ3MjIiLCJjbGllbnRfaWQiOiI2dXBvZGhscG45YTQ4anVkc3JkcTExa2ZlbSJ9.m1XkA7f2gvQaoCqZ-PkWrujGWIKNaqdNaEJhOvFZuzXtALwuUXChF4MjlWttn0G04OhoHZBGEWhnY2oWlw4YGAjlBTXhKvgt5lArPuJ0aLDqliBTIcQ7r7acbmyFPK_j52omkpK_smag1QlsjabKD1TsP8Jd0_Z4e56jYetS6CqYZ3L1SjxXJ7AktcErxSVFCDquL5YlstiBh72354bgWRpPSjaCPqXV_ST847JHkXonXDuhEraR1KVepdADIBHHnrsKjJqBYGBsuVJnW3h_KPR4FZHVr77JpRvIUCOCkd5fhJar-j2lg8SkLPBAcxNRvBxuq_of4kYudkCIRugpjgMfAe%2bti68kuXfQDpaEnRVw%3d%3dIf the token is accepted, your request is passed along to the API, which then either succeeds or fails for its own reasons. However, if the token isn’t accepted, you’ll get a 401 HTTP status from our API gateway.
To generate an access token, you must first request your credentials through our Corporate Banking Team and request access to the APIs that you want to use. If you haven’t registered as an Open Banking Allied yet, you should do so now contacting our Open Banking Team:
The OAuth flow is your key to unlocking access tokens. There's no path to programatically create (or retrieve) API access credentials without our Corporate Team intervention.