Changelog

#2026-08

• Discovery at /.well-known/oauth-authorization-server (RFC 8414) with the open_banking_io extension.
• response_mode defaults to form_post (the spec default is query): the relay carries the user's key and never rides a query string. Configure your client library to request and accept form_post.
• /oauth/authorize errors after client validation are delivered by form_post to the redirect URI with error, error_description, iss and state; earlier errors answer 400 with a JSON body.
• /oauth/token accepts the standard form-encoded request with client_secret_basic or client_secret_post, answers RFC 6749 errors, and adds access_token, token_type, expires_in and scope to the response. The JSON request shape and the apiKey, apiBaseUrl, user fields keep working.
• Keys may be sent as Authorization: Bearer ebk_… as well as X-Api-Key.
• POST /oauth/revoke (RFC 7009) and GET /oauth/userinfo.
• The relay carries iss.
• A wrong client secret answers 401 { "error": "invalid_client" } (was an empty 401).
• The sync failure partner_app_inactive (503).
• Each partner runs on its own Enable Banking application; each user connecting through a partner lives in a tenant of their own.

#Other SDKs

The Node client is the reference for Connect helpers. Go, Python, .NET, Java, PHP, Ruby and Rust read data with the same key and decrypt the same envelopes; the flow itself is plain OAuth 2.0 with PKCE and any client library that supports form_post and client_secret_basic will do.