TPP management access

To modify TPP information, authenticate with an OAuth2 client-credentials grant . This grant is for machine-to-machine authentication and does not require user interaction.

All TPPs can request the tpp:write scope by default, which is required for modifying TPP settings.

The OAuth2 API follows the standard OAuth2 specification. Use a tested, stable OAuth2 client rather than implementing the protocol yourself.

Obtain a TPP access token

Make a client-credentials request to obtain an access token for TPP operations:


POST https://auth.openbanking.prod.lunar.app/oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic <base64(client_id:client_secret)>
 
grant_type=client_credentials&scope=tpp:write

Update redirect URIs

Redirect URIs are the callback URLs to which users are sent after completing an OAuth2 authorization flow. Only registered redirect URIs can be used in authorization requests. Update them with the PATCH /tpp/redirect-uris endpoint.


PATCH https://api.openbanking.prod.lunar.app/tpp/redirect-uris
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>
X-Request-ID: <UNIQUE_REQUEST_ID>
 
{
  "redirectUris": [
    "https://mycompany.com/oauth2/callback",
    "https://mycompany.com/alternative-callback"
  ]
}

A successful request returns 204 No Content.

The X-Request-ID header is required and must be unique for the request. It provides idempotency: retrying a request with the same ID returns the same result.

The complete redirect-URI update flow is:

Verify your certificate

Verify that your eIDAS certificate is correctly configured with the /tpp/verify endpoint. This is useful when troubleshooting mTLS connectivity issues.


GET https://api.openbanking.prod.lunar.app/tpp/verify

This endpoint requires mTLS with your eIDAS certificate. A 200 OK response indicates that the certificate is valid and properly configured.