TL;DR
- An open banking API lets a third-party provider read account data or start a payment, with the customer’s consent.
- The flow is consent, redirect to the bank, a scoped access token, an API call and revocable consent.
- PSD2 requires banks to give providers secure access (in practice, mostly through dedicated APIs), Strong Customer Authentication and eIDAS certificates for providers.
- Standards differ by region: Berlin Group, STET, UK Open Banking, FDX, with FAPI as a security profile on top.
- Authentication rests on OAuth 2.0 and OpenID Connect, hardened with mTLS or signed requests.
- Integration takes eight steps, from choosing your regulatory role to monitoring after launch.
- Best practices: clear consent UX, data normalization from day one, fallbacks and automated certificate rotation.
- Regulation keeps moving: PSD3 and the PSR in the EU, and an unsettled Section 1033 rule in the US.
Introduction
Open banking has moved from a regulatory obligation to working infrastructure. Open banking API integration unlocks account aggregation, payments straight from the account and automated financial data, but it demands careful handling of authentication, customer consent and security.
The scale is already large. In early 2026, the UK had more than 16 million active open banking users, roughly one in five consumers and small businesses, and payment volumes grew 53% year on year, according to TechRepublic, citing Open Banking Limited and FCA data. By mid-2026, Open Banking Limited reported more than 19 million active user connections and over 40 million payments a month. In the EU, the Council and Parliament reached a provisional political agreement on PSD3 and the PSR in November 2025. The final application timeline depends on formal adoption and the applicable transition period. The new rules bring stricter demands on API performance and availability, as Morrison Foerster summarizes.
This open banking integration guide covers what an open banking API is, how it works, what PSD2 requires, the main standards, authentication and security, the integration steps, best practices, examples and the state of regulation.
What Is an Open Banking API
If you are asking what is open banking API in practical terms, it is a standardized interface through which third-party providers (TPPs), with the customer’s consent, get access to account data or initiate a payment.
- Roles under PSD2: ASPSP (the bank that holds the account), AISP (access to account information) and PISP (payment initiation).
- The modern approach replaces screen scraping with a secured API and explicit customer consent.
How Does an Open Banking API Work
So how does open banking API work from the customer’s side? In five steps:
- The customer gives an app (a TPP) consent to access data or make a payment.
- The customer is redirected to the bank and authenticates, usually with SCA.
- The bank issues an access token limited in scope and lifetime.
- The TPP calls the API, reading account data or initiating a payment.
- The customer can review and withdraw consent at any time.
Open Banking PSD2 API: What the Regulation Requires
The open banking PSD2 API rules set out several obligations:
- Banks must give TPPs secure access to accounts, usually through a dedicated API interface; the rules also allow access through the bank’s own customer interface.
- Strong Customer Authentication: at least two independent elements from the knowledge, possession and inherence categories, per the EBA.
- TPPs identify themselves with eIDAS certificates (QWAC or QSealC).
- PSD3 and the PSR will raise the bar: API performance and uptime, limits on dependence on fallback interfaces, IBAN and payee name checks and a refund regime for APP fraud.
Open Banking API Standards
Open banking API standards vary by market:
- Berlin Group NextGenPSD2: a widely used API standard in the EU.
- STET: the French PSD2 API standard.
- UK Open Banking Standard: specifications from Open Banking Limited for the UK.
- FDX API: the financial data exchange standard in the US.
- FAPI (Financial-grade API): a security profile of OAuth 2.0 and OpenID Connect for sensitive financial APIs, used on top of regional standards.
Open Banking API Authentication
Open banking API authentication is built from a handful of mechanisms working together:
- OAuth 2.0 and OpenID Connect: the base mechanism for authorization and token issuing.
- FAPI profile: mutual TLS or JWT client authentication, signed requests, pre-registered redirect URIs and short-lived tokens. Nordic APIs has an overview.
- Holder-of-key: the client proves it owns the key through mTLS or JWS.
- SCA: customer authentication at the bank under PSD2.
- Consent management: storing, updating and revoking customer consents.
Open Banking API Security
Open banking API security comes down to a short list of habits:
- Sender-constrained tokens with a short lifetime.
- Certificate management: registration, rotation and revocation.
- Rate limiting and abuse protection.
- Data minimization: request only the scopes you need. Our glossary covers data privacy and data protection.
- Audit logging of every API call and consent action.
- Monitoring of bank API availability and response time.
How to Integrate an Open Banking API: Step by Step
Here is how to integrate open banking API connections without surprises. Our glossary has a general entry on API integration.
- Define the use case and your regulatory role: AISP, PISP or ASPSP.
- Choose the model: direct connections to banks or an aggregator.
- Complete registration and obtain certificates.
- Implement the consent flow and authentication.
- Build a data normalization layer, because formats differ between banks.
- Implement error handling, retry logic and fallback.
- Test in each bank’s sandbox and run security testing.
- Launch, monitor and support.
Open Banking API Best Practices
These open banking API best practices come up on almost every project:
- Design the consent UX so customers understand what they are granting.
- Plan data normalization from the first day.
- Have a fallback and a clear behavior when a bank’s API is down.
- Automate certificate and token rotation.
- Log every call and every consent change.
- Test each bank’s sandbox separately.
- Track regulatory changes and specification versions.
Open Banking API Examples
A few open banking API examples show where the value is:
- Account aggregation: accounts from different banks in one app.
- Payment initiation: payments straight from the account, without card interchange fees.
- Lending: checking income and spending for credit scoring.
- Identity and KYC: confirming a person and an account from bank data.
- Accounting automation: loading transactions into accounting systems; see our accounting integration work.
Regulatory Landscape: EU, UK and US
- EU: PSD2 is in force; a provisional political agreement on PSD3 and the PSR was reached in November 2025; the application date depends on formal adoption and the transition period.
- UK: Open Banking Limited leads implementation under FCA oversight, and a new future entity is being set up to take over its role.
- US: the CFPB’s Section 1033 rule took effect on 17 January 2025, but a federal court barred its enforcement on 29 October 2025 while the CFPB reconsiders it, and in August 2026 the CFPB sent a new proposal for review before publication, as PYMNTS reports. The status changes quickly, so check it before you rely on it.
How Dotcode Can Help
We start with discovery: your use case, your regulatory role and the banks and markets you need. Then we build a single integration layer for bank APIs and payment providers, with security by design. It draws on our fintech integration services and our broader API and system integration services.
For product teams, the same layer powers mobile banking apps. If AI is part of your roadmap, read our article on AI integration in fintech. Browse the fintech industry page, check client feedback on Clutch or visit the Dotcode homepage.
Final Thoughts
A successful open banking API integration depends on well-thought-out authentication, consent management and data normalization. It is simpler and cheaper to build them into the architecture from the start than to retrofit a solution for new regulatory requirements.
FAQ
What is an open banking API?
A standardized interface that lets third-party providers access account data or initiate payments with the customer’s explicit consent. It replaces screen scraping with a secured, regulated channel.
How does an open banking API work?
The customer consents in a third-party app, is redirected to the bank and authenticates, the bank issues a scoped token, the app calls the API and the customer can withdraw consent at any time.
What is the open banking PSD2 API?
It is the interface, usually a dedicated API, that PSD2 requires banks to provide so licensed TPPs can read account information and initiate payments, protected by Strong Customer Authentication and eIDAS certificates.
How do you integrate an open banking API?
Define your role, choose direct connections or an aggregator, register and get certificates, build consent and authentication, normalize data, handle errors, test in sandboxes, then launch and monitor.
How secure are open banking APIs?
Security rests on OAuth 2.0 and OpenID Connect with a FAPI profile, mTLS or signed requests, short-lived sender-constrained tokens, certificate management, rate limiting and full audit logging.
What standards do open banking APIs follow?
Berlin Group NextGenPSD2 and STET in the EU, the UK Open Banking Standard in the UK and FDX in the US, with FAPI as the security profile on top.
