Authorization
Lunar uses OAuth2 to let users authorize a Third Party Provider (TPP) to access account data or initiate payments. This section explains the user authorization flow and token lifecycle.
User authorization
Use the OAuth2 authorization-code flow to request a user’s authorization in the Lunar app. You can also add optional application and purpose context so users understand who will receive their data.
Refresh tokens
Request the offline scope to maintain access without asking the user to authorize the connection again.
Token revocation
Revoke access or refresh tokens when a user withdraws their consent.
Client management
To manage a registered TPP, see Client Management. Management operations use a plain client-credentials token; no scope is required.
Scopes
Your client is registered for the PSD2 roles you requested during registration, plus offline:
PSP_AIfor account information servicesPSP_PIfor payment initiation servicesofflinefor refresh tokens
Requesting a scope your client is not registered for fails with invalid_scope.