Authentication

Adyen uses OAuth 2.0, an open standard for authorization, to allow third-party applications access data on behalf of their users with their explicit consent.

Here's how the OAuth flow works with Open Banking:

1. In your client app, the user selects to grant access to their payment data with Adyen.
2. Your client app redirects the user to Adyen's authentication interface so they can authenticate and give their consent for data access or payment initiation capabilities.
3. Adyen generates an authorisation code and returns it to your client app through the redirect URL.
4. Your server uses the authorisation code to get an access token.

After you get the access token, you can use it to consume Adyen's Open Banking APIs to access user's payment data or initiate payments on their behalf depending on the granted scope.

Implement the Adyen connect button

In your app or on your website, implement a Connect with Adyen button. Use the URL from the next step to get user's consent.

Redirect user for authentication

To redirect the user to the grant consent dialog, make a GET /bankoauth/tpp-connect request. This request doesn't require any type of authorization. Provide the following query parameters:

Authentication type: this request doesn't require any type of authorization.

By including these parameters, the authorization server can properly authenticate the user. The authentication process includes obtaining user's consent and redirecting them back to the client with the necessary information, such as an authorization code.

Here's an example of a GET request:

The response contains HTML code. Use this code to embed it into your app or website so the user can proceed with authentication.

After the user is successfully authenticated, a response is sent back to your client's redirect_uri. The URL contains the following appended parameters.

An example of a redirect URL may look like this:

Get access token

To exchange the authorisation code from the previous step for an access token, make a POST /token request. Provide the following parameters in the request body:

Authentication type: use client_id and client_secret for basic authentication.

The response contains the following fields:

Refresh access token

Because the access token is short-lived, a new access token has be requested regularly to continue using Open Banking APIs.

To refresh an access token, make a POST request to the /token endpoint. Provide the following parameters in the request body:

Authentication type: use client_id and client_secret for basic authentication.

The response contains the following fields:

{
    "token_type": "bearer",
    "expires_in": 86400,
    "access_token": "oa_Elnme5TE0FH0v8qXEAQ56ME0Zxp0s1ETtGizd07mEY0MTh1",
    "refresh_token": "oa_T7ZKiG5HsdTBAstDksw4WslQhbQQr0CwfSom90NkSV9w8zB"
}