Quickstart

Five steps, each linking the page with the depth. You need an approved partner account on staging (apply at staging.open-banking.io/app/partner-request, approved within 2 working days — a production partner account has no account on staging, and the other way round), Node 20+, and an inbox you can read.

#1. Install your decryption key — 5 min

Open staging.open-banking.io/app/partner#decryption-key → Generate a key in this browser → download the file → tick the box → Install decryption key. Note the fingerprint.

The private half is encryptionKey.privateKey in the file. We never see it and cannot recover it — your decryption key is the page about it. Until this step is done, step 2 and every authorization are refused.

#2. Create a Connect client — 3 min

Same page, Connect clients: redirect URI http://localhost:3000/callback, matched character for character. Copy the secret now; it is shown once. You have CLIENT_ID (obc_…) and CLIENT_SECRET (obs_…).

#3. Run a server — 5 min

Copy the one-file Express example to server.mjs:

npm i express cookie-parser @open-banking-io/client
ISSUER=https://staging.open-banking.io SELF_URL=http://localhost:3000 \
CLIENT_ID=obc_… CLIENT_SECRET=obs_… \
RECIPIENT_PRIVATE_KEY=$(node -pe 'JSON.parse(require("fs").readFileSync("open-banking-io-decryption-key.json")).encryptionKey.privateKey') \
node server.mjs

The boot line prints the fingerprint of the key it loaded. It must equal the one from step 1 — a different one means users are being sealed to a key nobody holds. Check it after every deploy, forever (why).

#4. Connect the sandbox bank — 15–30 min the first time

Open http://localhost:3000/connect: sign in on staging with a typed code, approve, search for Mock ASPSP, and follow the sandbox's own sign-in. The first time, the mock bank is empty: press Create Account, add an account, and start again from /connect — the account persists. Tick the accounts, Authorize, and you land on /?connect=connected with the mock account listed once the first sync finishes.

The sandbox's steps, and what each error means, are in getting started → the sandbox bank.

#5. Prove the three outcomes — 5 min

Cancel on the login screen, decline on the consent screen, and disconnect then read: the first two reach your callback as error=access_denied, the third answers 401. Then tick Tested the full flow on staging in the checklist on your partner page.

#Next

Getting started for production, security checklist before the first real user, FAQ for everything this page raised.