PSD2 POST request postman sandbox

akubishon

We are trying to connect and authorize as a PSD2 user. We have tried doing this with the Java SDK + Tinker, with no luck. We switched to Postman to have stable support and use POST and GET requests. Following the steps on https://doc.bunq.com/#/ and https://medium.com/bunq-developers-corner/sdk-update-connect-and-authorize-as-a-psd2-user-in-10-minutes-2516a87d796b, leaves us hanging when trying to pass the test certificate, the certificate chain and the installation Token when calling POST v1/payment-service-provider-credential.
Below you see our POST requests
We have tried every possible combination of keys being passed. The server public key, we got from the post request installation, had a few ‘\n’ in it so later on we got rid of those, but still insufficient authentication. Could you please us what we are possible doing wrong, or is going wrong? What is also quite confusing is the “403 Forbidden error”, it isn’t an authentication error. We’re confused and are looking forward to your help. Thanks in advance!

https://imgur.com/a/PV0949O

Bastiaan

Enes Hello!

Looks like you're requesting the endpoint /v1/payment-service-provider-credential/oauth-client instead of /v1/payment-service-provider-credential ?

You need to POST the following JSON body to this (/v1/payment-service-provider-credential) endpoint:

{ "client_payment_service_provider_certificate": "<cert>", "client_payment_service_provider_certificate_chain": "<cent>", "client_public_key_signature": "<signature>" }

akubishon

Bastiaan Hey Bastiaan, thanks for the lead, indeed the "oauth-client" wasn't supposed to be there , but after removing that and using the JSON body you sent as a template, I still get an authentication error. The public key signature I get has "\n"'s in it, we've tried it with and without those but still the same. I've tried requesting a new "client_public_key_signature" and using that, sadly, I get the same authentication error. The medium article states "pass the test certificate, the certificate chain and the installation Token". I've also tried adding the Token to the body. I've no clue what my next step could be. I'm looking forward to hearing from you :). https://imgur.com/a/2L1iyoN

Bastiaan

Enes I've created an example some months ago, check it out here:
https://github.com/basst85/bunq_psd2_example

Only the sign part for the X-Bunq-Client-Signature header value is changed. You only have to sign the body contents now, not the whole request.
Update: I've updated the example on Github.

akubishon

Hey Bastiaan, thanks a lot for the repository, I see you've created a client_pub_key.pem, I can't seem to find/generate mine. How did you generate that?

Bastiaan

Enes You can generate this 2048 bits RSA key pair with "OpenSSL".

Create client private key:
openssl genrsa -out client_private_key.pem 2048

Create Client public key, based on the private key:
openssl rsa -in client_private_key.pem -outform PEM -pubout -out client_public_key.pem

akubishon

Bastiaan Okay, so hear me out, I have generated the client public and private key. Changed the insides of "StringToSign" with my client public key + installation key ". Used the two command to sign the string and get a base64 signature. But where do I use that signature?

Bastiaan

Enes You have to use it in the POST request to /v1/payment-service-provider-credential, as the value of client_public_key_signature in the body JSON

akubishon

Bastiaan Alright so I used that signature as the value of client_public_key_signature in the body. I changed the client_public_key_signature in HttpRequest accordingly. I use the commands to sign the HeaderSignature and HttpRequest, then transform the HeaderSignature into base64. I fill everything into Postman. Now I get the error "invalid signature for public key". Is there something that I'm doing wrong? Thanks for helping me out.

Bastiaan

Enes You have to use the PSD2 certificate (cert.pem) as value for client_payment_service_provider_certificate and client_payment_service_provider_certificate_chain in the POST JSON to /v1/payment-service-provider-credential

It's indeed very confusing because you have the client RSA keys (client_private_key.pem and client_public_key.pem) and the PSD2 key and certificate (key.pem and cert.pem) 🙂

akubishon

Bastiaan Now I get an error saying that the client certificate and client certificate chain is invalid. I generated the cert.pem using the command provided by the bunq docs. Before I just used your cert.cert for both of the values. 🥺🥺

akubishon

Bastiaan The cert.cert in the repository works for both of the values. Cert.pem is invalid. I noticed the client_public_key_signature I generate is longer than the one in the repository. So at the moment I just use your cert.cert which seems to work but the client_public_key_signature is still invalid.

Bastiaan

Enes Hi!

I've updated the repository. Added more info and hopefully make it more clear 🙂
https://github.com/basst85/bunq_psd2_example

akubishon

Bastiaan Hey Bastiaan,

With the update to the new repository, it's pretty much fool-proof :). The certificate I generated goes through with no problems, but I'm sad to say that the client_public_key_signature is still the stubborn one. Sheesh, "invalid signature for public key". I'm clueless. Looking forward to hearing from you. Thanks a lot :)

Bastiaan

Enes Can you maybe try it without the header X-Bunq-Client-Signature?

akubishon

Bastiaan Still the same invalid signature for public key error :(

Bastiaan

Enes Are you sure you have regenerated all the keys and certificates and used them in the request to /v/install and StringToSign.txt?

I've followed all my steps again and can't simulate that error in the Sandbox environment.

akubishon

Bastiaan I followed all your steps yesterday with a friend of mine watching 😅 just to make sure I don't miss any steps, but I'll try again in a few minutes and keep you up to date :).

akubishon

Bastiaan Tried it again, but it's still invalid :( would you mind taking a look at a screen recording I made? I could send the link through email since adding it on here sounds a bit as a "privacyschending".

Bastiaan

Enes You can contact me via Telegram or Twitter: @basst85