Authorization

Lunar uses OAuth2 to let users authorize a Third Party Provider (TPP) to access account data or initiate payments. This section explains the user authorization flow, token lifecycle, and the credentials used to manage your TPP integration.

User authorization

Use the OAuth2 authorization-code flow to request a user’s authorization in the Lunar app. You can also add optional application and purpose context so users understand who will receive their data.

Authorize a user

Refresh tokens

Request the offline scope to maintain access without asking the user to authorize the connection again.

Use refresh tokens

Token revocation

Revoke access or refresh tokens when a user withdraws their consent.

Revoke tokens

TPP management access

Use a client-credentials token to manage your TPP configuration, including registered redirect URIs.

Manage your integration

Scopes

All TPPs are granted the tpp:write and offline scopes by default. The following scopes are also available when requesting user authorization:

• PSP_AI for account information services
• PSP_PI for payment initiation services