Obtaining Tokens via Code Flow

Initial token retrieval

Complete two requests in sequence:

a request to obtain the state and code parameters (needed for the token request),
a request for the tokens themselves.

Requesting the code and state parameters

To reach the Raiffeisen Bank /authorize endpoint, send a GET request in the following format:

GET https://sso.rbo.raiffeisen.ru/authorize?scope=openid profile email phone&client_id={your_client_id} &response_type=code&redirect_uri={your_redirect_uri}&state={your_state}&nonce={your_nonce}&prompt=login&code_challenge={your_code_challenge}&code_challenge_method=S256

Parameter reference

Parameter	Required	Description
scope	Yes	Fixed value: `openid profile email phone`
client_id	Yes	System identifier assigned by the bank after your integration request is approved
response_type	Yes	Fixed value: `code`
redirect_uri	Yes	The URI specified during setup (can be changed in online banking under Integrations)
state	Yes	A random value generated by your system. The bank returns it unchanged in the response. Your system should verify that the returned value matches the original. Used to prevent cross-site request forgery (CSRF).
nonce	No	An optional random value generated by your system. Returned unchanged inside the token. Used to prevent token replay attacks.
prompt	No	Optional. Specifies the type of user interaction with the bank's service. Fixed value: login
code_challenge	Yes	Derived from `code_verifier` — a cryptographically random string: `code_challenge = BASE64URL-ENCODE(SHA256(ASCII(code_verifier)))` See Proof Key for Code Exchange (PKCE) for details.
code_challenge_method	Yes	Fixed value: `S256`
max_age	No	Token lifetime in seconds (maximum 24 hours / 86,400 seconds)

After the request is sent, you will be redirected to a login page where the end user enters their credentials.

Enter your online banking login and password and click "Sign in". You will be redirected to your system's Redirect URI, and the code and state parameters will be appended automatically. On successful authorization, the response will have status 303 with the following header:

Location: {your_redirect_uri}?code={your_code}&state={your_state}

The code value is the Authorization Code. You will need it in the next step.

Access Token Request

Use Basic Authentication in the token request.

Before the request, generate the Authorization Basic string. The Authorization header value is formed from client_id and client_secret, separated by a colon and encoded using the Base64URL Encode algorithm. Below is an example of Base64URL generation for a system where:

client_id = a12b123b-0a12-3b4c-123a-12a3456789b1
client_secret = clientsecret7Fjfp0ZBr1KtDRbnfV

Base64URL Generation Example

Base64.encode('your_client_id' + ":" + 'your_client_secret') =
YTEyYjEyM2ItMGExMi0zYjRjLTEyM2EtMTJhMzQ1Njc4OWIxOmNsaWVudHNlY3JldDdGamZwMFpCcjFLdERSYm5mVg

To get access tokens, send a POST request:

POST /token
Host: https://sso.rbo.raiffeisen.ru
Content-Type: application/x-www-form-urlencoded
Authorization: Basic {Authorization Basic}

Body:
grant_type=authorization_code&
client_id={your_client_id}&code={your_code}&
redirect_uri={your_redirect_uri}&
code_verifier={your_code_verifier}

The Content-Type header contains the value application/x-www-form-urlencoded. This means that the request body must be in key=value format with & as the delimiter. For example: client_id=my_id&redirect_uri=https%3A%2F%2Fexample.ru%2Fredirect When using CURL, the request body is automatically formatted.

Parameter Description

Parameter	Required	Description
grant_type	Yes	Static value `authorization_code`
client_id	Yes	The system identifier obtained from the bank after submitting the connection application
code	Yes	The code transmitted by the Raiffeisen Bank service to `redirect_uri`
redirect_uri	Yes	The URI specified during connection.
code_verifier	Yes	A cryptographic randomly generated string. For more details on how to create `code_verifier` — Proof Key for Code Exchange (PKCE)

The response will contain tokens in JSON format:

{
  "access_token": "your_access_token_JWT",
  "token_type": "Bearer",
  "refresh_token": "your_refresh_token",
  "id_token": "your_id_token_JWT"
}

Refreshing tokens with a refresh token

When token expires, API requests will return HTTP 401. To continue, refresh the access token using your refresh_token by sending a POST request:

POST https://sso.rbo.raiffeisen.ru/token
Authorization: Basic {Authorization Basic}
Content-Type: application/x-www-form-urlencoded

Body:
grant_type=refresh_token&
client_id={your_client_id}&
refresh_token={your_refresh_token}

Parameter reference

Parameter	Required	Description
grant_type	Yes	Fixed value: `refresh_token`
client_id	Yes	System identifier assigned by the bank after your integration request is approved
refresh_token	Yes	A token used to renew `access_token` and `id_token`

The response will contain the tokens in JSON:

{
  "access_token": "your_access_token_JWT",
  "token_type": "Bearer",
  "refresh_token": "your_refresh_token",
  "id_token": "your_id_token_JWT"
}

Instructions for obtaining tokens according to the OpenID Connect 1.0 - Code Flow protocol