Getting tokens with Code Flow
Get access tokens to work with the bank's services. After authorization, you can submit payments and generate statements.
Sandbox tokens are static. The flow mirrors the production scenario, but the response always returns the same token pair for your session. Lifetimes:
access_token and id_token — 24 hours; refresh_token — 30 days.Start authorization
GET /authorize checks Code Flow parameters and returns 303 with the /signin form address in the Location header.
Derived from the session's code_verifier.
The sign-in form URL will appear here after authorization.
Open the sign-in form
GET /signin returns the test online-bank HTML form and a CSRF token for submitting credentials.
The CSRF token will appear here after receiving the sign-in form.
Sign in using the test online banking form
POST /login submits login, password, and CSRF token. On success, returns 303 with code and state parameters at the Redirect URI.
The authorization code will appear after signing in to the test online bank.
Exchange the code parameter for tokens
POST /token. Authorization: Basic from client_id:client_secret.
Tokens will appear here after a successful code exchange.
Refresh tokens with refresh_token
When access_token expires, requests will return 401. Refresh does not require re-authentication.
Refreshed tokens will appear here after the refresh_token request.
All authentication endpoints
Each endpoint is available for independent calls. Click a card to expand request parameters.
Check error handling
These actions add expected errors to the request console.