Authentication

Authenticate with the Kang Open Banking API using API keys (Bearer tokens) or OAuth 2.0 with PKCE. Full scopes table, FAPI 1.0 Advanced posture, mTLS, and worked examples.

Authentication Methods

Kang Open Banking supports two complementary authentication methods. Use API keys for server-to-server merchant integrations, and OAuth 2.0 with PKCE for third-party Open Banking apps acting on behalf of an end user.

1. API Keys (Bearer tokens) — Merchant integrations

Send your secret key as a Bearer token on every request. Sandbox keys start with sk_test_; live keys start with sk_live_. Never expose secret keys in client-side code.

curl https://api.kangopenbanking.com/v1/gateway/charges \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Idempotency-Key: $(uuidgen)"

2. OAuth 2.0 + PKCE — Third-party Open Banking apps

OAuth 2.0 Authorization Code flow with PKCE (S256) is mandatory for all interactive flows per FAPI 1.0 Advanced § 5.2.2. Public clients (mobile, SPA) MUST use PKCE; confidential clients SHOULD use PKCE.

Step 1 — Generate PKCE pair

// Node.js
const crypto = require('crypto');
const verifier = crypto.randomBytes(32).toString('base64url');
const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');

Step 2 — Redirect user to /authorize

https://api.kangopenbanking.com/v1/oauth/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &scope=openid+accounts+balances+transactions+offline_access
  &state=RANDOM_STATE
  &nonce=RANDOM_NONCE
  &code_challenge=CHALLENGE
  &code_challenge_method=S256

Step 3 — Exchange code for tokens

curl -X POST https://api.kangopenbanking.com/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "redirect_uri=https://yourapp.com/callback" \
  -d "code_verifier=VERIFIER"

OAuth Scopes

Scope	Grants	Required For
`openid`	OIDC ID token	All OIDC flows
`profile`	User profile claims	Display user name/email
`offline_access`	Refresh token	Long-lived access
`accounts`	Read account list (AISP)	GET /v1/aisp/accounts
`balances`	Read account balances	GET /v1/aisp/accounts/*/balances
`transactions`	Read transaction history	GET /v1/aisp/accounts/*/transactions
`beneficiaries`	Read saved beneficiaries	GET /v1/aisp/accounts/*/beneficiaries
`payments`	Initiate payments (PISP)	POST /v1/pisp/payments
`gateway:read`	Read charges, payouts, refunds	Merchant read access
`gateway:write`	Create charges, payouts, refunds	Merchant write access

Token Lifetimes

Token Type	Lifetime	Rotation
Access Token	15 minutes	Non-rotating; request a new one via refresh
Refresh Token	30 days	Rotating — each use issues a new refresh token; reuse triggers session-wide revocation (OAuth 2.1 § 6.1)
Authorization Code	60 seconds	Single-use

FAPI 1.0 Advanced Posture

PKCE S256 mandatory on all /authorize requests
nonce required on OIDC requests
Pushed Authorization Requests (PAR) supported at POST /v1/oauth/par
mTLS bound access tokens via tls_client_auth (RFC 8705)
Request object signing supported (PS256, ES256)

Developer Portal Home | OpenAPI Spec (JSON) | Contact