Using the Signup Workflow for Berlin

This tutorial lets you try out a sample TPP onboarding process.

Step 01: Sign up as a TPP user

Follow the steps below to sign up as a TPP user: 

1. Navigate to the API Store.

2. Click Sign Up and navigate to the sign-up screen.   

   

3. Provide the requested details as defined below: 
   

   1. Generic Details 

      Field	Description	Sample Value
      Username/Email	The username/email the TPP user uses to sign in to the API Store.	tony@fincom.com
      Password	The password the TPP user uses to sign in to the API Store.
      Re-type Password	Re-type the password to prevent an incorrect password being set accidentally.
      First Name	The first name of the TPP user.	Tony
      Last Name	The last name of the TPP user.	Paige

   2. Company details 

      Field	Description	Sample Value
      Legal Entity Name	The official name of the TPP.	FinCom
      Country of Registration	The country in which the TPP is registered.	United Kingdom
      Legal Entity Identifier (LEI) Number	The legal entity number that identifies the TPP.	123400WSGIIACXF1P520
      Company Register	The organization that registered the TPP.
      Company Registration Number	The identifier issued at the TPP registration.
      Address Line 1	The address of the TPP.
      Address Line 2	The address of the TPP.
      City	The city in which the TPP is located.
      Postal Code	The postal code of the geographical location of the TPP.
      Country	The country in which the TPP is located.

   3. Competent Authority registration details 

      Field	Description	Sample Value
      Competent Authority	The regulatory body that authorizes and supervises the open banking services delivered by the TPP.	Financial Conduct Authority
      Competent Authority Country	The country of the Competent Authority that authorized the TPP to provide open banking services.
      Competent Authority Registration Number	The registration number issued by the Competent Authority to the TPP.
      URL of the Competent Authority Register Page	The URL of the page that has the list of organizations authorized by the given competent authority.
      Open Banking Roles	The open banking roles the TPP is willing to take up: Account Information Service Provider: An Account Information Service Provider (AISP) provides an aggregated view of all the accounts and past transactions that a customer has with different banks. To provide this view to the customer, the AISP should have authorization from the customer to view the corresponding transaction and balance information of all the payment accounts. The AISPs can also provide the facility to analyze the customer's spending patterns, expenses, and financial needs. Unlike a PISP, an AISP cannot transfer funds from a payment account.  Payment Initiation Service Provider: A Payment Initiation Service Provider (PISP) initiates credit transfers on behalf of a bank's customer. Payment Instrument Issuer Service Provider: A Payment Instrument Issuer Service Provider (PIISP) is a PSP that verifies the coverage of a given payment amount of the PSU's account. Examples of PIISPs are the banks and credit card issuers that are obligated to verify whether the given payment amount can be covered by the PSU's account through APIs. After selecting the roles, indicate whether the TPP is authorized by a competent authority to provide the services of the selected roles. If the TPP has not yet registered to provide the services of the selected roles, indicate whether the TPP has applied for registration.

4. Agree to the terms and conditions by selecting the check box.

5. Click Sign Up. 

   

   If you have configured workflows to Open Banking that is described here, a request to approve the user sign up is sent to the admin users. 

Step 02: Approve the TPP user account

Follow the steps below to approve the newly created TPP user account:

1. Navigate to the Admin Portal.  

2. Locate the approval request and click Assign To Me.    

   

3. Click Start to start the approval process.
   
4. Select Approve and click Complete.
   
   The TPP user can now sign in to the API Store.

Step 03: Sign in as a TPP user

Follow the steps below to sign in to the API Store:

1. Navigate to the API Store.
2. Click Sign In and navigate to the sign in screen.
   
3. Enter the username and the password you entered at the user sign up.
4. Click Sign In.
   
   The API Store home screen with the APIs appears. Remain in the API Store to create an application.

Step 04: Create an application

An application is an intermediary that sits between an API and its consumer. API consumers use applications to subscribe to APIs and consume them.

An API consumer can subscribe to multiple APIs using a single application. Thus, it acts as a logical collection of API subscriptions and decouples the API consumer from the APIs. Each application can be associated with different Service Level Agreement (SLA) levels. This is enabled by attaching an application with throttling tiers that determine the maximum number of API calls allowed during a given duration.

Follow the steps below to create an application:

1. In the API Store, click Applications.
2. Click Add Application.
   

3. Enter the application details. 

   Field	Description	Sample Value
   Name	The application name.	FinComApp
   Per Token Quota	Determines the maximum number of API requests accepted within a given duration.	Unlimited
   Description	Describes the purpose of the application.

   

4. Click Add to create the application.  
   
   Remain on the same page to generate application access tokens. 

Step 05: Create the certificates

Follow the steps below to create a public key certificate, and application certificate:

1. Update the place holders of the following command and run it in a command prompt to create a keystore, which is a repository of security certificates. 

   • alias: This is a preferred alias for the keystore.

   • preferred-filename: This is a preferred name for the keystore. You can even enter the location where you want the keystore to be generated.     

   keytool -genkey -alias <<alias>> -keyalg RSA -keystore <<filename>>.jks 

   Example:

   keytool -genkey -alias KeyStore -keyalg RSA -keystore tpp.jks

   
   
    Click here to see a single command to create the certificate, and set certificate attributes

   keytool -genkey -alias <<alias>> -keyalg RSA -keysize 2048 -keystore <<filename>>.jks -dname "CN=<<Common Name>>,OU=<<Organization Unit>>,O=<<Organization>>,L=<<Locality>>,S=<<StateofProvice Name>>,C=<<Country Name>>" -storepass <<password>> -keypass <<password>>

2. Provide a password for the keystore, and setup the hostname by providing the following certificate attributes for the newly created certificate when prompted:

   • Common Name (CN)

   • Organizational Unit (OU)
   • Organization (O)
   • Locality (L)
   • StateofProvince Name (S)

   • Country Name (C) 

3. Update the place holders of the following command and run it in a command prompt to extract the certificate from the generated keystore.  

   1. alias: The alias of the keystore.

   2. fileName: The name of the certificate.

   3. keyStoreName: The name of the keystore. 

   keytool -export -alias <<alias>> -file <<fileName>> -keystore <<keyStoreName>>.jks 

   Example:

   keytool -export -alias KeyStore -file cert -keystore tpp.jks

4. Provide the password you used for the keystore.
   The public key certificate is extracted to the same location where you ran the command.    

5. Update the placeholders of the following command, and run in a command prompt to convert the keystore from the jks format to PKCS12. 

   1. keyStoreName: The name of the keystore. 

   2. PKCS12FileName: The name of the keystore in the PKCS12 format. 

   keytool -importkeystore -srckeystore <keystoreStoreName>.jks -destkeystore <<PKCS12FileName>>.p12 -deststoretype PKCS12

   Example:

   keytool -importkeystore -srckeystore tpp.jks -destkeystore tpp.p12 -deststoretype PKCS12

6. Update the place holders of the following commands, and run in a command prompt to create the application certificate (.pem) file using the keystore, in the PKCS12 format, e.g., tpp.p12.  

   1. PKCS12FileName: The name of the keystore in the PKCS12 format. 

   2. PEMFileName: The name of the application certificate that is created in the .pem format. 

   openssl pkcs12 -in <<PKCS12FileName>>.p12 -nokeys -out <<PEMFileName>>.pem

   Example:

   openssl pkcs12 -in tpp.p12 -nokeys -out tpp.pem 

Step 06: Request access tokens

Step 07: Approve the access key generation

Follow the steps below to approve the access key generation:

1. Navigate to the Admin Portal.
2. Click Tasks > Application Registration.
   
3. Locate the approval request and click Assign To Me.
   
4. Click Start to start the approval process.
   
5. Select Approve and then click Complete.
   
6. Navigate back to the API Store and click Applications. 
7. Click View of the application that you created in Step 04, e.g., FinComApp to navigate to the application details page.
   
8. Click Production Keys tab.
   
   Observe the generated keys. 
   
   Next, you can subscribe to APIs available in the API Store and invoke them.