OPEN BANKING TALES FROM THE FRONTIER Anca Zaharia Jason Maude - PowerPoint PPT Presentation

OPEN BANKING TALES FROM THE FRONTIER Anca Zaharia Jason Maude @ancaleuca @jasonmaude

What is open banking? The legislation and associated technology that allow customers of financial institutions greater control of data that those institutions hold about them.

Who are Starling Bank? • Tech start-up with a banking licence • ~100% cloud-based, mobile-only • All the features that you’d expect from a current account and more • Public APIs & developer platform

Public APIs • Most actions that can be performed through the mobile apps are available • Allows individuals to connect up their bank account to their own code

The Starling Bank marketplace • Allows customers to securely connect to selected partners via their Starling Bank account • Providers of mortgages, pensions, savings and investments etc

LESSON 1: UNDERSTAND OAUTH 2

OAuth 2 overview Auth Resource User Client server server

Client authentication 1. Redirect Partner Auth web app app https://oauth.starlingbank.com ● cl client_id =$client_id ● re response_type =code ● st state =$state ● re redire rect_uri ri =$redirect_uri

Client authentication 1. Redirect 2. Send QR code Starling Auth web Partner app app app

Client authorisation 1. Redirect 2. Send QR code Starling Auth web Partner app app app 3. Login, review permissions

Client authorisation 1. Redirect 2. Send QR code Starling Auth web Partner app app app 3. Login, review permissions Starling 4. Authorise API 5. Generate auth code

Client authorisation 1. Redirect 2. Send QR code Starling Auth web Partner app app app 3. Login, review 6. Poll for permissions auth code Starling 4. Authorise API 5. Generate auth code

Client authorisation 1. Redirect 2. Send QR code Starling Auth web Partner app app app 7. Redirect 3. Login, review 6. Poll for permissions auth code /redirect_uri ● st state =$state ● co code =$auth_code Starling 4. Authorise API 5. Generate auth code

Exchange auth code for access token Starling API Partner API POST https://api.starlingbank.com/oauth/access-token Request Response ● code =$auth_code co ● access_token ac ● cl client_id =$client_id ● refre re resh_token ● client_secr cl cret =$client_secret ● token_type=Bearer ● grant_type=authorization_code ● ex expires_ es_in ● redirect_uri=$redirect_uri ● sc scope

Use access token Starling API Partner API -H "Authorization: Bearer $ ac access_token " https://api.starlingbank.com/api/v1/accounts/balance

Example screens for Wealthify using 2-way OAuth flow

Additional security • Highly sensitive requests (e.g., payment instructions) must be sig igned

Token storage ● Don’t forget to delete expired tokens

LESSON 2: YOU CAN’T ALWAYS CONNECT

Things will go wrong

Losing requests and responses Request Partner Starling API API Request Response

DITTO architecture The system must ensure that every instruction from a user is actioned at least once and at most once

Losing requests - at least once Request Partner Starling API API

Losing responses - at most once Request Partner Starling API API Response

LESSON 3: MAKE TESTING EASY

Personal access Developer Portal account Starling Bank account

Personal access $ curl -H “Authorization: Bearer <personal access token>” https://api.starlingbank.com/api/v1/tr ansactions

What if I want more?

Play in the sandbox

LESSON 4: WORK ON YOUR PERMISSIONS MODEL

Permission model v1 Tier 5 Make payments Tier 4 Create payees Tier 2 Tier 1 Tier 3 Read personal Read financial Write financial

Permission model v2 Create Delete Read Edit Payees DD Mandates Address Metadata Create Read Read Create Savings Goal Transactions Balance Local Payment

Displaying permissions

LESSON 5: MONITOR YOUR API

Monitoring and observability stack Instana Prometheus Grafana Alertmanager Elastalert Pagerduty Elasticsearch Logstash Kibana

THE FUTURE

Open integration platform Open Starling API Partner integration API platform

Share your identity confirmation KYC Starling API Partner API

Key takeaways • Lesson 1: Understand OAuth • Lesson 2: You can’t always connect • Lesson 3: Make testing easy • Lesson 4: Work on your permissions model • Lesson 5: Monitor your API

Thank you! Check out the Starling Developer Podcast! https://developer.starlingbank.com @ancaleuca @jasonmaude