Platform changelog

Authorization

2026-08-24

End-user application context in authorization requests

• The /oauth2/auth endpoint now accepts two optional parameters that give the user more context before they approve a connection:
  • end_user_application_name identifies the application that will receive the user’s data. It must be valid UTF-8, contain no control characters, and be no longer than 200 characters after leading and trailing whitespace is removed.
  • use_case describes the purpose for using the data. Supported values are ACCOUNTING, PERSONAL_FINANCE, CREDIT_ASSESSMENT, RISK_MANAGEMENT, PAYMENT, BANKING, and OTHER.
• This is intended for aggregators that retrieve data on behalf of another application. The Lunar app continues to show the TPP name derived from its eIDAS certificate; the new parameters add context and do not replace that identity.
• Both parameters are optional. Unsupported or invalid values are ignored, so they do not prevent the authorization flow from starting.

This authorization-server enhancement is not part of the versioned Account Information and Payment Initiation API specification. See User authorization for the request format and complete validation rules.