Authentication

This article is dedicated to authentication as an Account Information Service Providers (AISP). The full documentation is available in the Authentication API Reference.

Step 1: Obtain Access Token

Use the OAuth2 Authorization Code flow to obtain an access token:

Authorization Request

Endpoint: /oauth/authorize

CURL

curl -X GET "https://{agentName}.{stage}.secure.openbanking.treezor.co/oauth/authorize?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}&scope=aisp&state={state}"

Parameters

Attribute	Description
response_type	Must be "code"
client_id	Your client identifier
redirect_uri	Your registered callback URL
scope	Required scope (e.g., "aisp", "aisp extended_transaction_history")
state	CSRF protection token (recommended)

Token Request

Endpoint: /oauth/token

CURL

curl -X POST "https://{agentName}.{stage}.secure.openbanking.treezor.co/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code={authorization_code}" \
  -d "redirect_uri={redirect_uri}" \
  -d "client_id={client_id}" \
  -d "client_secret={client_secret}"

Response

JSON

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "def50200a8f7b9c...",
  "scope": "aisp"
}

Please note the token expires after 1 hour.

Step 2: Use Access Token

Include the access token in all API requests Authorization header. Here is an example:

CURL

curl -X GET "https://{agentName}.{stage}.secure.openbanking.treezor.co/aisp/accounts" \
  -H "Authorization: Bearer {access_token}" \
  -H "X-Request-ID: {unique-request-id}"

Step 3: Refresh Token

When the access token expires (after 1 hour), use the refresh token grant type. Refresh tokens are valid for 180 days.

Endpoint: /oauth/token

CURL

curl -X POST "https://{agentName}.{stage}.secure.openbanking.treezor.co/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token={refresh_token}" \
  -d "client_id={client_id}" \
  -d "client_secret={client_secret}"