Skip to main content

OAuth in Mobile Apps

Workflow Diagram​

A workflow diagram of the OAuth in mobile apps

Step 1

Create a Member​

Now we'll need to create an OAuth member, which you can do by setting the following:

  • "is_oauth": true.
  • client_redirect_url so we can send you UI messages with the right scheme. This can be any string, but we'll use https://mx.com in this guide.
  • "referral_source": "APP" tells MX to use the client_redirect_url you provided so you can get back to your app.

Remember that you cannot include end-user credentials in your request body when creating an OAuth member. The idea is to never share those with a third party.

Also, we recommend that you always include a unique id when creating any resource on the Platform API so you can easily sync between your systems and ours.

Endpoint: POST /users/{user_guid}/members

Request
Response
Language:shell

_14
curl -i -X POST 'https://int-api.mx.com/users/USR-11141024-90b3-1bce-cac9-c06ced52ab4c/members' \
_14
-u 'client_id:api_key' \
_14
-H 'Accept: application/vnd.mx.api.v2+json' \
_14
-H 'Content-Type: application/json' \
_14
-d '{
_14
"member": {
_14
"id": "unique_id",
_14
"institution_code": "mx_bank_oauth",
_14
"is_oauth": true,
_14
"metadata": "Additional information"
_14
},
_14
"referral_source": "APP",
_14
"client_redirect_url": "https://mx.com"
_14
}'

Step 2

Load the OAuth URI​

Now that you've got the oauth_window_uri from the last step, load it in the device's default browser.

warning

Do not open the OAuth window in a Webview. Some finanical instutitions have security restrictions for certain web containers or browsers. See OAuth WebView Limitations for more information.

oauth_window_uris are one-time use. Don't hard code an expected URI into your application.

Don't prepend the https:// protocol to the URI string, as MX includes this.

This is where the user will interact with the institution's OAuth page and determine what data will be shared with MX and, therefore, with you. Once the end user is done, they will be redirected to the URL you gave for client_redirect_url. We'll append to this URL information about success/error as well as the member GUID.

Example
Language:shell

_10
https://mx.com?status=success&member_guid=MBR-df96fd60-7122-4464-b3c2-ff11d8c74f6f

On this page