Getting tokens with Code Flow

The scenario mirrors the production process: call /authorize, /signin, and /login in sequence, then exchange the resulting code for tokens through /token. All values are prefilled with your session data.

Sandbox tokens are static. The procedure is identical to production, but the response always returns the same token pair for your session. Lifetimes: access_token and id_token — 24 hours; refresh_token — 30 days.

Start authorization

GET /authorize checks Code Flow parameters and returns 303 with the /signin form address in the Location header.

client_id

redirect_uri

state

code_challenge (S256)Derived from the session's code_verifier.

The sign-in form URL will appear here after the /authorize request.

Get the sign-in form

GET /signin returns the test online-bank HTML form and a CSRF token for submitting credentials.

The CSRF token will appear here after the /signin request.

Sign in to test online banking

POST /login submits login, password, and CSRF token. On success, returns 303 with code and state parameters at the Redirect URI.

The authorization code will appear after signing in to the test online bank.

Test account: test_user / sandbox.

Exchange code for tokens

POST /token. Authorization: Basic from client_id:client_secret.

Tokens will appear here after a successful code exchange.

The code is single-use: a repeated exchange will return invalid_grant.

Refresh tokens with refresh_token

When access_token expires, requests will return 401. Refresh does not require re-authentication.

Refreshed tokens will appear here after the refresh_token request.

All authentication endpoints

Each endpoint is available for independent calls. Click a card to expand request parameters.

Check error handling

These actions add expected errors to the request console.

Next: send ISO 20022 payments