Unable to associate certain bank account to card with API

Hendrik-Purple-Unicorn-3247177232

Hi all,
I'm developing a AWS Lambda function to associate my bank account to my card. In combination with Tasker on Android, I can then quickly link a specific bank account to my debit card. I got this working for the most part: for bank accounts that I originally created it works, but not for shared bank accounts that I co-own and someone else created.

After obtaining an API key using oauth2, I use the API (with either Postman or the Python SDK) to send this payload to {{host}}/v1/user/{{user_id}}/card/{{card_id}}:

https://bin.veracry.pt/?f0149370c85a8bde#EzU221NPaawrJArrkc9P5SNNnKjZQzZNDQJajpKiGy3P

and get the following response:
https://bin.veracry.pt/?34b782b3413d0c5e#JD9k8QxTpMvk2qMn8hWh5VdhSHCXbfhmA2KvTJUUrzJP

It does work when I use an API key that I generate through the app (i.e. without oauth2), but as this gives read/write access to everything on my account, I don't prefer to use that option.

I guess something need to be updated in the backend, or is there another way to achieve the above through the API?
Thanks in advance!
Kind regards,
Harmen

Jakob-Y

Harmen Hi Harmen, first: I had to remove the code blocks in your comment. Unfortunately there's a bug in the forum software used for Together that makes it impossible to reply to a thread otherwise. Hope that's fine!

for bank accounts that I originally created it works, but not for shared bank accounts that I co-own and someone else created

To me, that really just sounds like a limitation of the OAuth access. I would agree with you if you think that makes hardly any sense in this case. Maybe some bunq developer can chime in here and explain why this is the case or if this can be changed going forward. Or add some information to this topic: https://together.bunq.com/d/3016 or this page: https://beta.doc.bunq.com/basics/oauth

Really I think it would be great if there was a way to generate simple API keys with limited rights. That would make things so much better (+ not having to worry about OAuth if you're not actually developing SaaS for other people to use).