Protección

Consent Authorisation

Run the FAPI 2.0 authorization flow to obtain a customer's consent and a sender-constrained access token.

Consent Authorisation

Consent authorisation is how a customer grants you access to their data. The flow follows the FAPI 2.0 Security Profile: you push the request (PAR), the customer approves on Protección's consent screen, and you exchange the resulting code for a sender-constrained access token.

The flow at a glance

Step by step

1

Generate a PKCE verifier and challenge

Create a high-entropy code_verifier, then derive the code_challenge with SHA-256 (S256). Keep the verifier — you'll present it at the token endpoint.

code_verifier=$(openssl rand -base64 32 | tr -d '=+/' | cut -c1-43)
code_challenge=$(printf "%s" "$code_verifier" \
  | openssl dgst -sha256 -binary \
  | openssl base64 -A | tr '+/' '-_' | tr -d '=')
2

Push the authorization request (PAR)

Send the parameters directly to the PAR endpoint over mTLS. Choose the scopes and sharing duration the customer will be asked to approve.

curl -X POST --cert client.crt --key client.key \
  https://secure.proteccion.prod.provider.fiskil.com/connect/par \
  -d "client_id=your-client-id" \
  -d "response_type=code" \
  -d "redirect_uri=https://app.example.com/callback" \
  -d "scope=openid bank:accounts.basic:read bank:transactions:read" \
  -d "sharing_duration=7776000" \
  -d "code_challenge=$code_challenge" \
  -d "code_challenge_method=S256" \
  -d "state=opaque-anti-forgery-value"
{
  "request_uri": "urn:proteccion:par:9f2b1c7a4e8d",
  "expires_in": 90
}
3

Redirect the customer

Redirect the browser to the authorization endpoint with only client_id and request_uri. No scopes or sensitive parameters appear in the URL.

https://public.proteccion.prod.provider.fiskil.com/connect/authorize
  ?client_id=your-client-id
  &request_uri=urn:proteccion:par:9f2b1c7a4e8d

Protección authenticates the customer, fetches their account list from the resource server, and shows a consent screen listing the scopes and duration.

4

Receive the authorization code

After the customer approves, Protección redirects back to your redirect_uri with a one-time code, your state, and the iss parameter.

https://app.example.com/callback
  ?code=AUTH_CODE
  &state=opaque-anti-forgery-value
  &iss=https://public.proteccion.prod.provider.fiskil.com

Verify state matches what you sent and iss matches the expected issuer before continuing.

5

Exchange the code for tokens

Exchange the code over mTLS, authenticating with private_key_jwt and presenting the PKCE verifier.

curl -X POST --cert client.crt --key client.key \
  https://secure.proteccion.prod.provider.fiskil.com/connect/token \
  -d "grant_type=authorization_code" \
  -d "code=AUTH_CODE" \
  -d "redirect_uri=https://app.example.com/callback" \
  -d "code_verifier=$code_verifier" \
  -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
  -d "client_assertion=SIGNED_CLIENT_JWT"
{
  "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9...",
  "id_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token": "eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0...",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "openid bank:accounts.basic:read bank:transactions:read"
}

The id_token identifies the customer (sub); the access_token is bound to your certificate. Store the arrangement identifier from the ID token so you can manage the consent later.

Scopes

Request only what you need — the consent screen shows the customer exactly these scopes.

ScopeGrants access to
openidThe customer's stable identifier (required).
bank:accounts.basic:readAccount identifiers, names, and types.
bank:transactions:readTransactions on consented accounts.
common:customer.basic:readBasic customer profile.
energy:accounts.basic:readEnergy account details.

Sharing duration

sharing_duration is the consent lifetime in seconds. Common values:

ValueDuration
864001 day
6048001 week
777600090 days
315360001 year

Omitting it (or 0) requests a once-off, single-use consent.

Ask for the shortest duration your use case needs. Shorter, tighter consents earn customer trust and reduce your data-handling obligations.

Next step