Account retrieving with oauth token PSD2

New-Pink-Lion-2906228819

Hello,
as the PSD2 user I've tried to get an account using get v1/user with an oauth token but received {"Error":[{"error_description":"Insufficient authentication.","error_description_translated":"Insufficient authentication."}]}
Does the TPP has access to this action and if no how the TPPs should retrieve user id for the next AIS calls?

Bastiaan

Deviprasad Hi,

Check the following documentation page for an overview of the different TPP roles and rights: https://beta.doc.bunq.com/psd2/connect-as-a-psd2-service-provider

New-Pink-Lion-2906228819

Bastiaan thanks for the fast reply!
I've already checked this documentation and related AIS and PIS documentation as well but there no info about the steps between oauth token retrieving and first AIS call. I looking for the way to get 'userApiKey's id', could you please advice smth?

Bastiaan

Deviprasad The UserApiKey object is in the response of the endpoint /v1/session-server.
The response of this endpoint also contains the authentication token, which is needed as the X-Bunq-Client-Authentication header value in the request to for example /v1/user

New-Pink-Lion-2906228819

Bastiaan but the response of the endpoint /v1/session-server will return UserApiKey of the current PSD2 user when I need UserApiKey of the user that granted consent during the oauth for the AIS calls:
/user/{userID}/monetary-account
/user/{userID}/monetary-account/{itemId}
/user/{userID}/monetary-account/{monetary-accountID}/payment

Bastiaan

Deviprasad The UserApiKey-object contains the info of the user that accepts the OAuth request ("App connection").

New-Pink-Lion-2906228819

Bastiaan Correct me if I wrong, please:

TPP redirects the user to the bunq OAuth server
TPP exchange code to an access token
TPP calls post v1/session-server request (not sure which token should be placed as authorization here and what secret is)
TPP uses UserApiKey from step 3 as an ID and OAuth token as an authorization for the next AIS calls

Bastiaan

Deviprasad That's correct. Check this page for more info:
https://beta.doc.bunq.com/basics/oauth#user-id-vs-item-ids

New-Pink-Lion-2906228819

Bastiaan tried to call v1/session-server and faced this issue:
User credentials are incorrect. Incorrect API key or IP address.
Could you advise how can I fix it, please?
Here are full logs (unfortunately, cannot upload as a file)


 --> POST https://api-oauth.sandbox.bunq.com/v1/token?grant_type=authorization_code&code=00cbcb183486d52312eee18686d05fef98443a00621a4f076cdac0835100cdb6&redirect_uri=http%3A%2F%2Ftest-token.io%2Fcallback&client_id=7129f13d985430318c3b9a2c77dffc3a6f2ba5b3d2bf244ad55ae92f101ff2e7&client_secret=f37aba2ee43f0b646b119991f381021010a446aaa3e95490810584e28f9c7699
 Content-Length: 0
 Cache-Control: no-cache
 User-Agent: token-platform
 X-Bunq-Client-Signature: 05jIqYw3qMiPFBXLcoeWUxt3zxBx9TPS1+leb4H8VRXKnxY+chh/iEaKCPIULL4/cpDVE/whef7N8ujE3vE/NmU4E0vVGVLBS/9V58oVSff0XWRDHZwpw0Yy0tlp33zHOfzUywNSKirAR+jfBXG7Wpa4L0yMhTsEgEbp6aknn/3AlQAjazL1DL2JjK6ZY8QAn8+NU/m10h+dt9ZBQMVO0qTQE453le5Fd+PSo2idS7g+oaGCMATPyVYLs43Sm+nehhS3L047nsgWuVW6caHiz2bD1vKpvKsH98c/6JbCiaxdkLn40tLK/uRT17/YlEEnpGIrDxoRMDABZptlrz651A==
 --> END POST (0-byte body)

<-- 200 https://api-oauth.sandbox.bunq.com/v1/token?grant_type=authorization_code&code=00cbcb183486d52312eee18686d05fef98443a00621a4f076cdac0835100cdb6&redirect_uri=http%3A%2F%2Ftest-token.io%2Fcallback&client_id=7129f13d985430318c3b9a2c77dffc3a6f2ba5b3d2bf244ad55ae92f101ff2e7&client_secret=f37aba2ee43f0b646b119991f381021010a446aaa3e95490810584e28f9c7699 (684ms)
  date: Thu, 21 Jan 2021 13:49:48 GMT
  content-type: application/json
  server: Apache/2.4.29 (Ubuntu)
  access-control-allow-origin: *
  access-control-allow-methods: GET, POST, PUT, OPTIONS
  access-control-allow-headers: X-Bunq-Client-Request-Id, X-Bunq-Geolocation, Cache-Control, X-Bunq-Client-Authentication, X-Bunq-Client-Signature, User-Agent, Authorization, X-Bunq-Region, If-None-Match, X-Bunq-Language
 
  {"access_token":"92c8435aa6177a3f0bbcec6e8d8187211dc290a410fd01ae5d57ac6993804b19","token_type":"bearer","state":"tokenio-state__eyJ0eXBlIjoiTElOS0lORyIsImJhbmtJZCI6Im5ncC1idW5xIn0__"}
 <-- END HTTP (184-byte body)

 --> POST https://public-api.sandbox.bunq.com/v1/session-server
 Content-Type: application/json; charset=UTF-8
 Content-Length: 77
 X-Bunq-Client-Authentication: 4bee32d785df18385df80f5d156e857e81e3655f1a114344632c0d905942d816
 Cache-Control: no-cache
 User-Agent: token-platform
 X-Bunq-Client-Signature: URRS6CzUl3wV+1q+FS1VCG8cSLKW86qfgnIOuhrddcre54cUjzIkUYFO8sKGw+dWGRRKGJjR7znLI978Hc6mCCevPb5ZWoHY9UTBkCHrhojXyIkWsC2k8ahCjIbYj6p9GvggOwAa3FuGGisfqPbW/Ldh1LGu9PDrmGZUDYVT+lWjxuH+9k8KkbbGuJbi4RoaX1I/p8otCYfN+F4BiG0u3NtV70OeKN8eWQ2iuJgltyqjmOicoL0dGnhURv1ckk+xEuRn5mN5a1+mQSvwCZq6vkoFL++TZcPSB9O/JEmfqj2ZlcvedJLWsjqLJRA7Ya/9WVOhy+8xrm0JCNW0mqZqFQ==

 {"secret":"92c8435aa6177a3f0bbcec6e8d8187211dc290a410fd01ae5d57ac6993804b19"}
 --> END POST (77-byte body)
 <-- 400 https://public-api.sandbox.bunq.com/v1/session-server (484ms)
 date: Thu, 21 Jan 2021 13:49:48 GMT
 content-type: application/json
 server: Apache/2.4.29 (Ubuntu)
 x-bunq-client-response-id: c9d90bd6-6913-46c0-ac9a-333895547455
 x-bunq-server-signature: hrK1/bYtxbmRBylkLpQ1Wn5aa/DiBAXnBk3GMuRCs/AWFMA5ayNbFoyDwkplirA0GPvrdvqsI7WkO6i8wk8sHiJB8rHMm5cf6I7uemIIiGPLU2+3pR2Dp9pLZcrTNe7Uk+RXy6fTnELVVRiAJ/gKA8s6VFCzB1M7Sm1FHNEDRymzNhMb05MQPdLRR7OTw7zgOSc62duQTf6bQRmFrJU5Fdt3ua2nVuDFP8f529IkaAnbnR+ukMhgao4kerZJiIakift0XLIELu7vea9s7r2FcxmG0oYwq7R14Pp1i6NBSCU4rCQhH8NCJKR+cT5PDJo3UDrsGqgGVnkkiXEIlE1V7w==

 {"Error":[{"error_description":"User credentials are incorrect. Incorrect API key or IP address.","error_description_translated":"User credentials are incorrect. Incorrect API key or IP address."}]}
 <-- END HTTP (198-byte body)

New-Pink-Lion-2906228819

Bastiaan Hello, did you have a chance to take a look at our issue?

Bastiaan

Deviprasad Hi,

Sorry for the late response, missed your message.

It looks like the request to the device-server endpoint (https://public-api.sandbox.bunq.com/v1/device-server) is missing before the request to session-server

New-Pink-Lion-2906228819

Bastiaan Hi,
after multiple attempts I've realized that I don't quite sure about flow sequence and tokens which I should use on each step and prepared the list of questions for clarifying it:

Which token should I use (oauth or installation) for the /device-server call?
Should I perform /device-server call every time or just once for registering the device?
Which token (oauth or installation) should I use for the /session-server call?
Which token (or id) should I use as a secret in a request body to /devece-server and /session-server?

Bastiaan

Deviprasad Hi!

You can use the received access_token-value (from https://api.oauth.bunq.com/v1/token) as a normal API-key:
https://beta.doc.bunq.com/basics/oauth#whats-next

Check the following page for more information: https://beta.doc.bunq.com/basics/authentication