Quickstart
From credentials to your first consented data call in about 15 minutes.
Quickstart
This quickstart takes you end to end: register as a data recipient, set up mutual TLS, run a consent flow, and make your first authenticated data call against the staging instance.
Prefer the detail? Each step links to a full guide. This page is the happy path so you can see the whole shape at once.
Before you begin
You'll need:
- A client ID and a registered signing key (issued during onboarding).
- A client certificate for mutual TLS — see Set up mTLS.
- A redirect URI registered with Protección (where the customer returns after consenting).
Discover the instance endpoints
Every instance publishes an OpenID Connect discovery document. Fetch it once and read the endpoints from it — never hardcode URLs.
curl https://public.proteccion.staging.provider.fiskil.com/.well-known/openid-configuration{
"issuer": "https://public.proteccion.staging.provider.fiskil.com",
"pushed_authorization_request_endpoint": "https://secure.proteccion.staging.provider.fiskil.com/connect/par",
"authorization_endpoint": "https://public.proteccion.staging.provider.fiskil.com/connect/authorize",
"token_endpoint": "https://secure.proteccion.staging.provider.fiskil.com/connect/token",
"jwks_uri": "https://public.proteccion.staging.provider.fiskil.com/jwks",
"scopes_supported": ["openid", "profile", "bank:accounts.basic:read", "bank:transactions:read"],
"code_challenge_methods_supported": ["S256"],
"require_pushed_authorization_requests": true,
"tls_client_certificate_bound_access_tokens": true
}Set up mutual TLS
All calls to the token and data endpoints are made over mTLS using your registered client certificate. Confirm the handshake works before going further:
curl --cert client.crt --key client.key \
https://secure.proteccion.staging.provider.fiskil.com/connect/parA 400/401 response (rather than a TLS error) means the handshake succeeded. Full setup is in Set up mTLS.
Start a consent request (PAR)
Push the authorization parameters to Protección server-to-server. You get back an opaque request_uri.
curl -X POST --cert client.crt --key client.key \
https://secure.proteccion.staging.provider.fiskil.com/connect/par \
-d "client_id=your-client-id" \
-d "response_type=code" \
-d "redirect_uri=https://app.example.com/callback" \
-d "scope=openid bank:accounts.basic:read bank:transactions:read" \
-d "code_challenge=BASE64URL_S256_CHALLENGE" \
-d "code_challenge_method=S256" \
-d "sharing_duration=7776000"{
"request_uri": "urn:proteccion:par:9f2b1c7a4e8d",
"expires_in": 90
}Redirect the customer to consent
Send the customer to the authorization endpoint with only the request_uri and client_id. Protección presents the consent screen and, on approval, redirects back to your redirect_uri with a one-time code and the iss parameter.
https://public.proteccion.staging.provider.fiskil.com/connect/authorize
?client_id=your-client-id
&request_uri=urn:proteccion:par:9f2b1c7a4e8dFull walkthrough: Consent Authorisation.
Exchange the code for a token
Exchange the authorization code at the token endpoint, authenticating with private_key_jwt and presenting your PKCE verifier. You receive a sender-constrained access token bound to your client certificate.
curl -X POST --cert client.crt --key client.key \
https://secure.proteccion.staging.provider.fiskil.com/connect/token \
-d "grant_type=authorization_code" \
-d "code=AUTH_CODE_FROM_REDIRECT" \
-d "redirect_uri=https://app.example.com/callback" \
-d "code_verifier=YOUR_PKCE_VERIFIER" \
-d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
-d "client_assertion=SIGNED_CLIENT_JWT"{
"access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9...",
"id_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 900,
"scope": "openid bank:accounts.basic:read bank:transactions:read"
}Make your first data call
Present the bound token to a data endpoint. Because the token is certificate-bound, the same client certificate must be used on the request.
curl --cert client.crt --key client.key \
https://api.provider.fiskil.com/cds-au/v1/banking/accounts \
-H "Authorization: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCJ9..." \
-H "x-fapi-interaction-id: 4f3d2c1b-0a9e-8d7c-6b5a-4938271605fe"You now have consented data. Continue with Requesting Data for scopes, pagination, and error handling.