Skip to main content
Danske Bank logo

Onboarding Overview

Onboarding with Danske Bank requires valid eIDAS certificates (test/sandbox certificates issued by trusted CAs are allowed in the Sandbox). The certificates can be obtained with certified QTSPs.

Danske Bank provides "dynamic TPP registration" via a dedicated API that can be found in the OpenId configuration. It is advised to register in the Sandbox environment first so that a real account with Danske Bank is not required, and Sandbox PSU credentials can be used for testing.

The registration process is slightly different for Open Banking (UK specific) and PSD2 (whole world including UK).

  • Registration request for Open Banking UK should be sent as a signed JWT with content type application/jwt
  • Registration request for PSD2 should be sent as a JSON with content type application/json. Refer to detailed specs in respective section below.

The jwt.io page is a good reference to verify JWT is created using correct private/public key pair.

Onboarding is a 2 step process as shown on the sequence diagram below.

Sequence diagram showing the two-step TPP onboarding flow

Onboarding to Sandbox

Step 1. Obtain network and signing certs

To get access to Danske Bank's APIs you first need to obtain network and signing certificates from the qualified providers. For Open Banking UK apis you need to register with the Open Banking Directory and provide the necessary details using the UI. For PSD2 APIs you need to acquire eIDAS certificates from a QTSP. Next paragraphs describe each variant in more detail.
The Sandbox TPP registration endpoint is in Open Id configuration section.

Step 2. Register in Danske Bank

Once the TPP acquires the network and signing certificate it needs to register with Danske Bank. Danske Bank implements 'dynamic TPP registration' method via a dedicated API. The result of TPP registration are client credentials. These can be used by TPP for authentication in OAuth2 flows as described later in this documentation. The registration looks different for Open Banking Directory and eIDAS issued certificates.The OAuth2 authorization endpoint is in Open Id configuration section.

Onboarding with Open Banking UK directory

Step 1. Obtain OB network and signing certs

The TPP should follow the instructions provided by the Open Banking Directory to enroll with Open banking UK. Open Banking Directory is an UK based solution that allows TPPs to register themselves as trusted entities and get the necessary resources to start using Open Banking APIs from UK providers.
An enrolling tutorial is available here.

Step 2. Register OB certs in Danske Bank

TPPs that have OB Directory issued certificates are registered using the OAuth2 Dynamic Client Registration flow (rfc7591). Additional information about this method is provided on Openbanking UK confluence v3.2.
The Production TPP registration endpoint is in Open Id configuration.

Payload for this service is a registration JWT signed with TPPs signing certificate. A sample registration request (Decoded JWT) might look like this:

Header

{
  "alg": "PS256",
  "kid": "h0dUJoT5zuiE262r-ypmA3N9Kkk",
  "typ": "JWT"
}

Payload

{
  "iss": "1ndkRxliKRQPmFpOyMnLYO",
  "redirect_uris": ["https//tpp.domain.com/callback?optional=parameter"],
  "aud": "https://obp-api.danskebank.com",
  "scope": "openid accounts payments",
  "jti": "e0a3c4eb-6c6a-4607-b8bb-062e98d027db",
  "iat": 1576049708,
  "exp": 1576053308,
  "software_statement": "eyJhbGciOiJ...",
  "client_id": "1234567890",
  "id_token_signed_response_alg": "PS256",
  "request_object_signing_alg": "PS256",
  "token_endpoint_auth_method": "tls_client_auth",
  "grant_types": ["authorization_code", "refresh_token", "client_credentials"],
  "response_types": ["code id_token"],
  "application_type": "web"
}

Where notably:

  • iss - software_id value in the software statement provided by the Open Banking directory
  • aud - should match the issuer of the OpenId configuration
  • software statement - software statement provided by the Open Banking directory for a specific certificate
  • client_id - Open Banking Software Id

Example Software statement generated by Open Banking Directory for Danske Bank TPP:

{
  "iss": "OpenBanking Ltd",
  "iat": 1576049220,
  "jti": "7df469b980b74cf9",
  "software_environment": "production",
  "software_mode": "Live",
  "software_id": "1ndkRxliKRQPmFpOyMnLYO",
  "software_client_id": "1ndkRxliKRQPmFpOyMnLYO",
  "software_client_name": "TPP App Name",
  "software_client_description": "TPP App Description",
  "software_version": 1.1,
  "software_client_uri": "https://terms.openbanking.org.uk",
  "software_redirect_uris": ["https//tpp.domain.com/callback?optional=parameter"],
  "software_roles": ["AISP", "PISP", "CBPII"],
  "organisation_competent_authority_claims": {
    "authority_id": "FCAGBR",
    "registration_id": "122261",
    "status": "Active",
    "authorisations": [
      {
        "member_state": "LU",
        "roles": ["PISP", "AISP", "CBPII"]
      },
      {
        "member_state": "GB",
        "roles": ["AISP", "PISP", "CBPII"]
      },
      {
        "member_state": "IE",
        "roles": ["PISP", "AISP", "CBPII"]
      }
    ]
  },
  "software_logo_uri": "https://logo.openbanking.org.uk",
  "org_status": "Active",
  "org_id": "1ndkRxliKRQPmFpOyMnLYO",
  "org_name": "Northern Bank Limited t/a Danske Bank",
  "org_contacts": [
    {
      "name": "Technical",
      "email": "----",
      "phone": "----",
      "type": "Technical"
    },
    {
      "name": "Business",
      "email": "----",
      "phone": "----",
      "type": "Business"
    }
  ],
  "org_jwks_endpoint": "https://keystore.openbanking.org.uk/1ndkRxliKRQPmFpOyMnLYO/1ndkRxliKRQPmFpOyMnLYO.jwks",
  "org_jwks_revoked_endpoint": "https://keystore.openbanking.org.uk/1ndkRxliKRQPmFpOyMnLYO/revoked/1ndkRxliKRQPmFpOyMnLYO.jwks",
  "software_jwks_endpoint": "https://keystore.openbanking.org.uk/1ndkRxliKRQPmFpOyMnLYO/1ndkRxliKRQPmFpOyMnLYO.jwks",
  "software_jwks_revoked_endpoint": "https://keystore.openbanking.org.uk/1ndkRxliKRQPmFpOyMnLYO/revoked/1ndkRxliKRQPmFpOyMnLYO.jwks",
  "software_policy_uri": "https://policy.openbanking.org.uk",
  "software_tos_uri": "https://terms.openbanking.org.uk",
  "software_on_behalf_of_org": null
}

Onboarding with eIDAS for PSD2

Step 1. Obtain QWAC+QSeal certs

EIDAS is a short name for the EU Electronic Identification, Authentication & Trust Services Regulation. The document defines a legal framework for digital trust market in EU. Important definitions used in respect to eIDAS and Open Banking / PSD2:

QTSP – A Qualified Trust Service Provider – an organisation / company that can confirm the identity of a TPP and issue QWAC and QSealC for them. The qualified keyword means that the provided service is in line with EU laws and regulations. A list of trusted of QTSP for each EU country can be found here.
QWAC – Qualified Website Application Certificate – certificate used for establishing secure connections in the Internet (TLS) and identifying the connecting parties.
QSealC – Qualified Electronic Sealing Certificate – certificate used for digitally signing content sent over the Internet in a way that is legally bounding (non-repudiation).

PSD2 and Open Banking APIs (and Sandbox) accept QWACs and QSealCs for identifying TPPs (as network and signing certificates respectively). The method for obtaining them might differ for QTSPs in each country but it will most likely include the following steps:

  • TPP generates QWAC and QSealC certificate keys,
  • TPP generates CSRs for QWAC and QSealC keys in accordance to provided templates,
  • TPP submits CSRs and additional information to QTSP,
  • QTSP verifies TPPs request,
  • If the QTSP verification is successful TPP will receive QWAC and QSealC certificates signed by the QTSP.

Note! In QWACs and QSealCs is the 'Authorization number' included in organisation identifier. It's a unique identifier of the TPP that will be the same even if different QTSPs will be used. Details are in the 5.2.1 section here.

More information on eIDAS certificates can be found here and here.

Step 2. Register QWAC+QSeal in Danske Bank

Once the TPP has valid eIDAS certificates they should host a JWKS with QSeal public information for verification purposes.
The Production TPP registration endpoint is in Open Id configuration.
Payload for this service is a json containing a self-signed software statement. Payload syntax is described here. A sample payload might look like this:

Payload

{
  "token_endpoint_auth_method": "tls_client_auth",
  "tls_client_auth_subject_dn": "tpp.domain.com",
  "grant_types": ["authorization_code", "client_credentials"],
  "software_statement": "eyJhbGciO...",
  "id_token_signed_response_alg": "PS256",
  "request_object_signing_alg": "PS256"
}

For PSD2 the Software statement needs to be created by the TPP. An example decoded software statement is as follows:

{
  "iss": "PSDDK-DFSA-61126228",
  "iat": 1566816618,
  "exp": 1598672183,
  "aud": "https://psd2-api.danskebank.com",
  "jti": "A9B0D124-4B24-00D2-BAD9-2653766FA3B0",
  "software_id": "6878944F-795E-22E9-AB12-E0308C25D91B",
  "software_client_name": "TPP app name",
  "software_version": 1,
  "software_client_uri": "https//tpp.domain.com",
  "software_redirect_uris": ["https//tpp.domain.com/callback?optional=parameter"],
  "scope": [
    {
      "role": "AIS",
      "member_state": ["AT", "BE", "BG"]
    },
    {
      "role": "PIS",
      "member_state": ["AT", "BE", "BG"]
    },
    {
      "role": "CBPII",
      "member_state": ["AT", "BE", "BG"]
    }
  ],
  "software_logo_uri": "https//tpp.domain.com/logo.svg",
  "software_contacts": [
    {
      "name": "First business contact",
      "email": "----",
      "phone": "----",
      "type": "Business"
    },
    {
      "name": "First technical contact",
      "email": "----",
      "phone": "----",
      "type": "Technical"
    },
    {
      "name": "Second technical contact",
      "email": "----",
      "phone": "----",
      "type": "Technical"
    }
  ],
  "software_jwks_endpoint": "https//tpp.domain.com/jwks",
  "software_jwks_revoked_endpoint": "https//tpp.domain.com/jwks/revoked",
  "software_policy_uri": "https//tpp.domain.com/policy",
  "software_tos_uri": "https//tpp.domain.com/tos",
  "software_type": "web"
}

Where notably:

  • iss - should contain GURN i.e. Global Unique Reference Number : Combination of Country, Competent Authority Name and URN that is unique across Europe.
  • jti - should be GUID in UUID v4 format.
  • aud - should match the issuer of the OpenId configuration.
  • software_id - should be GUID in UUID v4 format if generated by the TPP.
  • software_client_name - The TPP name that will be displayed to the PSU during consent authorization and management.
  • software_contacts - TPP contact people.
  • software_jwks_endpoint - must contain x5c of the signing certificate, so that the signatures can be validated.
  • scope - ideally should be taken from PRETA directory, since Danske Bank validates the TPP access rights via the PRETA directory.

Signature

The JWT should be signed using the algorithm detailed in the OpenId-configuration by the QSeal certificate obtained from an eIDAS QTSP.

Previous
Open Id Configuration
Next
Api Authorization