zopa · OAuth Scopes

zopa OAuth Scopes

OAuth 2.0 derived

zopa publishes 2 OAuth 2.0 scopes via the clientCredentials and authorizationCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the zopa API on a user’s behalf.

Tokens are issued from https://authserver.example/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyBankingFintechOpen BankingPSD2PaymentsAccount InformationPayment InitiationFAPIUnited KingdomDigital BankLending

Scopes: 2 Flows: clientCredentials, authorizationCode Method: derived

OAuth endpoints

Authorization URL
https://authserver.example/authorization

Token URL
https://authserver.example/token

Flows
clientCredentialsauthorizationCode

Scopes (2)

Scope	Description	Flows
accounts	Ability to read Accounts information	authorizationCode, clientCredentials
payments	Generic payment scope	authorizationCode, clientCredentials

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-21'
method: derived
source: openapi/zopa-account-info-openapi-original.yml, openapi/zopa-payment-initiation-openapi-original.yml
schemes:
- name: TPPOAuth2Security
  source: openapi/zopa-account-info-openapi-original.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://authserver.example/token
  description: TPP client credential authorisation flow with the ASPSP
- name: PSUOAuth2Security
  source: openapi/zopa-account-info-openapi-original.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://authserver.example/authorization
    tokenUrl: https://authserver.example/token
  description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when
    a TPP wants to access an ASPSP resource owned by the PSU
- name: TPPOAuth2Security
  source: openapi/zopa-payment-initiation-openapi-original.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://authserver.example/token
  description: TPP client credential authorisation flow with the ASPSP
- name: PSUOAuth2Security
  source: openapi/zopa-payment-initiation-openapi-original.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://authserver.example/authorization
    tokenUrl: https://authserver.example/token
  description: OAuth flow, it is required when the PSU needs to perform SCA with the ASPSP when
    a TPP wants to access an ASPSP resource owned by the PSU
scopes:
- scope: accounts
  description: Ability to read Accounts information
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/zopa-account-info-openapi-original.yml
- scope: payments
  description: Generic payment scope
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/zopa-payment-initiation-openapi-original.yml