Consent Authorisation
Run the FAPI 2.0 authorization flow to obtain a customer's consent and a sender-constrained access token.
Consent Authorisation
Consent authorisation is how a customer grants you access to their data. The flow follows the FAPI 2.0 Security Profile: you push the request (PAR), the customer approves on Protección's consent screen, and you exchange the resulting code for a sender-constrained access token.
The flow at a glance
Step by step
Generate a PKCE verifier and challenge
Create a high-entropy code_verifier, then derive the code_challenge with SHA-256 (S256). Keep the verifier — you'll present it at the token endpoint.
code_verifier=$(openssl rand -base64 32 | tr -d '=+/' | cut -c1-43)
code_challenge=$(printf "%s" "$code_verifier" \
| openssl dgst -sha256 -binary \
| openssl base64 -A | tr '+/' '-_' | tr -d '=')Push the authorization request (PAR)
Send the parameters directly to the PAR endpoint over mTLS. Choose the scopes and sharing duration the customer will be asked to approve.
curl -X POST --cert client.crt --key client.key \
https://secure.proteccion.prod.provider.fiskil.com/connect/par \
-d "client_id=your-client-id" \
-d "response_type=code" \
-d "redirect_uri=https://app.example.com/callback" \
-d "scope=openid bank:accounts.basic:read bank:transactions:read" \
-d "sharing_duration=7776000" \
-d "code_challenge=$code_challenge" \
-d "code_challenge_method=S256" \
-d "state=opaque-anti-forgery-value"{
"request_uri": "urn:proteccion:par:9f2b1c7a4e8d",
"expires_in": 90
}Redirect the customer
Redirect the browser to the authorization endpoint with only client_id and request_uri. No scopes or sensitive parameters appear in the URL.
https://public.proteccion.prod.provider.fiskil.com/connect/authorize
?client_id=your-client-id
&request_uri=urn:proteccion:par:9f2b1c7a4e8dProtección authenticates the customer, fetches their account list from the resource server, and shows a consent screen listing the scopes and duration.
Receive the authorization code
After the customer approves, Protección redirects back to your redirect_uri with a one-time code, your state, and the iss parameter.
https://app.example.com/callback
?code=AUTH_CODE
&state=opaque-anti-forgery-value
&iss=https://public.proteccion.prod.provider.fiskil.comVerify state matches what you sent and iss matches the expected issuer before continuing.
Exchange the code for tokens
Exchange the code over mTLS, authenticating with private_key_jwt and presenting the PKCE verifier.
curl -X POST --cert client.crt --key client.key \
https://secure.proteccion.prod.provider.fiskil.com/connect/token \
-d "grant_type=authorization_code" \
-d "code=AUTH_CODE" \
-d "redirect_uri=https://app.example.com/callback" \
-d "code_verifier=$code_verifier" \
-d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
-d "client_assertion=SIGNED_CLIENT_JWT"{
"access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9...",
"id_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
"refresh_token": "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0...",
"token_type": "Bearer",
"expires_in": 900,
"scope": "openid bank:accounts.basic:read bank:transactions:read"
}The id_token identifies the customer (sub); the access_token is bound to your certificate. Store the arrangement identifier from the ID token so you can manage the consent later.
Scopes
Request only what you need — the consent screen shows the customer exactly these scopes.
| Scope | Grants access to |
|---|---|
openid | The customer's stable identifier (required). |
bank:accounts.basic:read | Account identifiers, names, and types. |
bank:transactions:read | Transactions on consented accounts. |
common:customer.basic:read | Basic customer profile. |
energy:accounts.basic:read | Energy account details. |
Sharing duration
sharing_duration is the consent lifetime in seconds. Common values:
| Value | Duration |
|---|---|
86400 | 1 day |
604800 | 1 week |
7776000 | 90 days |
31536000 | 1 year |
Omitting it (or 0) requests a once-off, single-use consent.
Ask for the shortest duration your use case needs. Shorter, tighter consents earn customer trust and reduce your data-handling obligations.