PSD2 Authoriser
Issues encrypted access tokens for the PSD2 platform. Token endpoints require x-api-key; signed token endpoints also require a request signature in Authorization. GET /open-banking/sandbox/auth/show uses Authorization: Bearer , without an API key or request signature. Application errors have plain text or empty bodies. API Gateway errors are separate.
Customer sandbox via OneAPI
auth (Collapsed)
Encrypted access token using a signed request
Issues an encrypted access token after verifying the request signature. Send Authorization: Signature ... and x-api-key. Sign the request target, Date, Content-Type, Accept and a digest computed from the body. V2 supports SHA-256 and SHA-512; the legacy V1 format is also accepted. Signature verification happens before JSON parsing. Malformed JSON with a valid signature currently returns 500.
Headers
- Type: stringx
-correlation -id Correlation ID for tracking requests across multiple services.
- Type: stringDaterequired
Request signing time. Must be a valid date within five minutes of the server time, in either direction.
- Type: stringAccept
Media type included in the signed data. Required for V2 signatures; use application/json. Legacy V1 also accepts an omitted header by signing the literal value undefined.
Body·
Exactly one of userId or tenantUserId must be nonempty. An empty value for the other field is accepted. In multi-tenant mode, userId must have the configured tenantId_tenantAppId_ prefix; tenantUserId is prefixed by the service. In single-tenant mode either value is used unchanged. Unknown fields are rejected.
JSON request for an encrypted access token. Exactly one of userId or tenantUserId must be nonempty. An empty alternative is accepted. Identity validation runs after schema validation.
- Type: stringtenant
User Id Tenant user id associated with the JWT token. Typically as used within the tenant's system.
- Type: stringuser
Id User ID. In multi-tenant mode it must start with the configured tenantId_tenantAppId_ prefix. In single-tenant mode it is used unchanged.
Responses
- application/json
- */*
- */*
- 403
API Gateway rejected the API key or access policy before invoking the handler.
- */*
- default
Other errors generated by API Gateway or the integration. These are not application error objects.
curl https://api.acc.ockto.cloud/auth/open-banking/sandbox/token \
--request POST \
--header 'Date: Wed, 21 Oct 2026 12:00:00 GMT' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic username:password' \
--header 'x-api-key: YOUR_SECRET_TOKEN' \
--data '{
"userId": "companyA_app1_user674638475",
"tenantUserId": "user674638475"
}'
{
"token": "string",
"user_id": "string",
"tenant_user_id": "string",
"tenant_id": "string",
"tenant_app_id": "string",
"role": "string"
}Encrypted access token and user identity.
Tenant and app identity
Returns tenantId and tenantAppId from the bearer access token. No API key or request signature is required. The handler returns 200; authentication failures are generated by API Gateway or its authorizer.
Responses
- application/json
- 401
API Gateway rejected a missing bearer token.
- 403
The authorizer denied the bearer token.
- default
Other errors generated by API Gateway or the integration. These are not application error objects.
curl https://api.acc.ockto.cloud/open-banking/sandbox/auth/show \
--header 'Authorization: Bearer YOUR_SECRET_TOKEN'
{
"tenantId": "string",
"tenantAppId": "string"
}ShowResponse
