Getting started

#Getting a partner account

Sign in to open-banking.io and apply at Partner request. We review applications within 2 working days; once approved, you manage everything below at open-banking.io/app/partner with that same login.

On staging (https://staging.open-banking.io) you can build and test the whole journey against the sandbox's Mock ASPSP before any of the production steps below. Staging is a separate environment with its own accounts: create an account there, file the same partner request, and we approve it within 2 working days. Its sandbox Enable Banking application activates itself within about 15 minutes of approval; a staging Connect client is then all you need. Staging clients, secrets and keys do not exist on production.

#Before your first production user

Three things must exist before a user can complete Connect against your production client:

1. your decryption key, installed on your partner account,
2. an active Enable Banking application on your partner account, and
3. a Connect client (client id obc_…, client secret obs_…, redirect URIs).

The key comes first, and it is required: without it you cannot register a Connect client at all, and /oauth/authorize refuses every authorization with temporarily_unavailable and an error_description naming the missing key. See bring your own decryption key — it is a P-256 key pair, a paste, and a possession challenge. Keep the private half: it is the only thing that can read your users' data, and nobody, including us, can recover it for you.

The application comes next. While it is on file but not yet active, every attempt to start a bank connection (POST /api/authorizations) returns 503 with title: "partner_app_inactive" — no production user can connect until Enable Banking approves the application, and nothing on your side speeds that up. Handle the status in your integration as "try again later", not as a retryable error.

#Enable Banking application

You do not need an Enable Banking account. When we approve your partner request we register a production application for you under our own Enable Banking account, and your partner page shows its state:

• Pending — registered, waiting for Enable Banking's review. They check each application by hand and need a privacy policy URL and a data-protection contact mailbox on your domain; both are asked for on the request form, so there is nothing more to send. Build and test on staging (sandbox) in the meantime — its application is separate and activates on its own within about 15 minutes. To run the production flow before the review is through, whitelist one of your own bank accounts as a test account (below).
• Test mode — you whitelisted a test account and Enable Banking activated the application in restricted mode. Your production Connect flow works, but only the whitelisted accounts return data; anyone else who connects gets an empty account list, so keep production users out. The status becomes Active when Enable Banking's review lands, and we email you.
• Active — Enable Banking approved it. Every bank session your users open is signed with your own application, and we email you the moment this happens.

#Test accounts (whitelisting your own bank account)

Enable Banking lets a pending production application be activated by linking the owner's own bank accounts to it. On your partner page, under Test accounts, pick the country, the bank and personal/business, then Whitelist test account. Within a couple of minutes a bank link appears; open it and authenticate at your bank, or copy the link and send it to the colleague who holds the bank credentials. The flow runs through Enable Banking's own pages and ends on enablebanking.com — that is expected; close that window when you are done. The link is valid for one hour, after which the attempt disappears from the card — expired attempts are only counted, not listed — and you start a new one to get a fresh link.

Only whitelisted accounts return data in test mode — Enable Banking strips every other account from the response, so a user with an unlisted account sees an empty account list rather than an error. Whitelist every account you intend to test with; you can add more at any time, also after test mode is on. One request at a time. Once someone has authenticated at the bank, the account appears under Linked accounts on the same card — the list refreshes on its own while the page is open, and you can sort it by bank, account or when it was linked — and your application switches to Test mode. That list is exactly what Enable Banking will return data for.

We generate the RSA-4096 keypair and the certificate ourselves; the private key never leaves the server unencrypted. Credential changes take effect within 60 seconds.

#Branding

Under Partner → Connect branding you set what your users see while they are on open-banking.io: a display name, a logo, an accent colour, and support and terms links. Every Connect screen — login, bank picker, consent — wears them, with a "Back to {your name}" button that returns the user to your callback with error=access_denied. The emailed code (challenge=pin_code) is titled "Your code to connect your bank to {your name}" and explains that open-banking.io sends it on your behalf; the magic-link email stays ours.

• The logo must be an https:// URL; it is fetched and served through our own host, never hot-linked. Use a wide, rectangular PNG, JPEG or WebP (ideally at least 240×48 with a transparent background; SVG is not accepted) — it is rendered at 28 px height next to your name.
• Support and terms links must live under your registered domain when one is pinned.
• The accent is a #rrggbb colour; it drives buttons and links on the Connect screens.

#Consent card co-branding

The consent card spells out what agreeing means in plain language: your app reads the accounts they choose (if you have registered your own decryption key it says so, and the user is never asked for a passphrase; otherwise your app receives a copy of the key their browser made), access lasts until they disconnect it, disconnecting stops future reads but does not delete data already copied, and access keys are issued for at most 365 days. It names the co-branded pair once — "{app} by {partner}" — and links to the user's Connected apps page (/app/developers) where grants can be reviewed and revoked.

• Purpose — one sentence (max 280 characters, single line) saying what your app uses the data for. It is shown verbatim under the app name, e.g. "Track your spending without spreadsheets."
• Privacy URL — your privacy notice, linked from the consent card and the footer; https:// and under your registered domain when one is pinned.
• Default language — the language a visitor with no choice of their own sees the Connect screens in, one of the languages we ship (da, de, en, es, fi, fr, it, nb, nl, pl, pt, sv). The language switcher stays available.

The footer always carries "Powered by open-banking.io" — it is not removable, and it opens a short explanation of why the user is on our domain and how their data is protected.

Without branding, the screens show your partner account's name in the header, your client's display name on the consent card, and no logo, accent or links.

#Connect client

Under Partner → Connect clients you create a client and register its redirect URIs. The button is refused until your decryption key is installed.

• The client secret is shown once. Rotating it keeps the previous secret valid for 24 hours.
• Redirect URIs must be absolute https:// URLs (or http://localhost for development) with no fragment, matched exactly.
• Revoking a client stops new authorisations immediately; keys already issued keep working until they are revoked themselves.