Open Banking Authentication

Benefits

Software Statement Assertions (SSA) and Access Tokens

1. 1
   Receive SSA: As part of the OAuth 2.0 Dynamic Client Registration Protocol, you’ll receive an SSA that describes your software and permissions. Use this SSA to register for access to NewDay Open Banking APIs.
2. 2
   Generate Credentials: Upon registering your SSA, an OAuth client ID and secret credentials will be created.
3. 3
   Request Access Token: Send a registration request to our endpoint using your SSA as a string in the request body (formatted as a valid JSON Web Token).
4. 4
   Choose Grant Type: For API requests, you can use either the Client Credentials grant type (simpler, passing client ID and secret to the Authentication server) or the Authorisation Code grant type.
5. 5
   Access Tokens: The NewDay authorisation server issues bearer tokens in exchange for credentials, allowing you to perform actions on behalf of the resource owner. Tokens are valid for a limited time; you can reuse them until they expire and request new ones via a refresh token if applicable.

Open Banking Issued Certificates

The Open Banking Directory issues three types of certificates:

1. 1
   Signing Certificates: Used to create JWSs for signing JSON Web Token (JWT) payloads during onboarding and authorisation.
2. 2
   Encryption Certificates: Encrypt JWT payloads and ID tokens.
3. 3
   Transport Certificates: Facilitate mutual TLS for encrypting communication between third parties and banks.

Mutual Authentication

To access NewDay Open Banking APIs, ensure proper setup of your transport certificate:

1. 1
   APIs use Open Banking Certificate Authority-issued transport certificates, which must be trusted by your application. Avoid implementing certificate pinning unless you can automate certificate updates, as certificates expire every 12 months.
2. 2
   Sandbox APIs and OAuth Server Authorisation URLs do not enforce Mutual Authentication TLS (MATLS). However, The OAuth endpoint used to issue access tokens is protected by MATLS. You must use the transport certificate issued to you by the Open Banking Directory to exchange an authorisation code for an access token. NewDay will also ensure the TLS certificate being used matches that of the Software Statement used to onboard the authenticating OAuth client.

By following these steps, you can ensure secure and compliant access to NewDay's Open Banking APIs.