Skip to main content

​
Registration

You can’t use OAuth with all institutions. Some institutions support OAuth, some don’t, and some only support OAuth, which means you won’t be able to authenticate using ordinary credentials. Before you can use OAuth, you must register with the financial institution. This registration process is what provides the tokens required for a successful and secure authentication. We handle all these registrations for you, but you must request production access to the Platform API first. Request production access and apply for OAuth registration on the Client Dashboard. Until we’ve registered you with an OAuth institution, that institution doesn’t appear in any institution endpoint responses. To test OAuth flows before you have production access, use the OAuth test institutions in the integration environment. See Testing the Platform API.

​
Guides

These guides explain how to work with OAuth when integrating with the MX API.

​
OAuth WebView Limitations

OAuth flows require you to facilitate the redirect to the OAuth provider. Do not open the OAuth window in a WebView. Some institutions, such as Chase, have security restrictions for certain web containers or browsers. OAuth URLs cannot be launched within insecure containers because these containers allow the mobile application or desktop app to intercept customer input and thus intercept customer credentials. If a user is on one of these containers, the OAuth flow will be blocked during the redirect. To reduce this risk, do not open the OAuth window in a WebView. Instead, load the OAuth URI in an ASWebAuthenticationSession (iOS) or Auth Tab (Android). We provide both supported and unsupported methods:
Supported and unsupported containers may change as technology changes. The technology used to launch the OAuth flow must have the ability to prevent credential interception.