Get a management access token

Use an OAuth2 client-credentials grant to obtain a token for TPP management operations. Use the clientId and clientSecret returned during TPP registration.

Request tpp:write explicitly. A token issued without this scope cannot edit your TPP configuration. Mint a new token; an existing token does not gain the scope automatically.

Request a token

Environment	Token endpoint
Production	`https://auth.openbanking.prod.lunar.app/oauth2/token`
Sandbox	`https://auth.sandbox.openbanking.prod.lunar.app/oauth2/token`


CREDENTIALS=$(echo -n "your-client-id:your-client-secret" | base64)
 
curl \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Authorization: Basic $CREDENTIALS" \
  -X POST \
  -d "grant_type=client_credentials&scope=tpp:write" \
  https://auth.openbanking.prod.lunar.app/oauth2/token

The token endpoint uses HTTP Basic authentication (client_secret_basic) and does not require eIDAS mTLS.

Use the token

The response contains an access_token. Send it in subsequent management requests:


Authorization: Bearer <access-token>

Some management operations have additional requirements. For example, adding a certificate also requires mTLS with your existing valid eIDAS QWAC and private key.