BMO Financial Group · Authentication Profile

Bank Of Montreal Authentication

Authentication

BMO Financial Group secures its APIs with oauth2 and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and jwt-bearer flow(s).

Financial ServicesBankingCanadaBig SixCommercial BankingPaymentsTreasuryOpen BankingConsumer-Driven Banking
Methods: oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode, jwt-bearer API key in:

Security Schemes

OAuth2 oauth2
· flows: authorizationCode, jwt-bearer
OpenIDConnect openIdConnect
Encryption message-encryption

Source

Authentication Profile

bank-of-montreal-authentication.yml Raw ↑ 
generated: '2026-07-23'
method: searched
source: >-
  https://api.bmo.com/.well-known/openid-configuration (live OIDC discovery) +
  https://developer.bmo.com/api/commercial/ (BMO Authorize API, OAuth 2.0)
docs: https://developer.bmo.com/api/commercial/product
notes: >-
  Derived from BMO's live OIDC discovery document and the documented Authorize
  API. Full per-endpoint OpenAPI security is partner-gated (an approved BMO
  Online Banking for Business organization account is required to view the API
  Explorer specs), so scheme details below are grounded in the anonymous OIDC
  discovery endpoint plus the portal's published auth description.
summary:
  types: [oauth2, openIdConnect]
  oauth2_flows: [authorizationCode, jwt-bearer]
  oidc_issuer: https://api.bmo.com
  encryption_required: true
schemes:
- name: OAuth2
  type: oauth2
  description: >-
    OAuth 2.0 access tokens issued by the BMO Authorize API grant applications
    access to the Account Information, Account Validation, Image Retrieval, and
    Payment APIs across sandbox, pre-production, and production environments.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.bmo.com/aac/sps/oauth/oauth20/authorize
    tokenUrl: https://api.bmo.com/aac/sps/oauth/oauth20/token
  - flow: jwt-bearer
    grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
    tokenUrl: https://api.bmo.com/aac/sps/oauth/oauth20/token
  sources: [well-known/bank-of-montreal-openid-configuration.json]
- name: OpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://api.bmo.com/.well-known/openid-configuration
  issuer: https://api.bmo.com
  provider: IBM Security Verify (VerifymeOIDC)
  userinfo_endpoint: https://api.bmo.com/aac/sps/oauth/oauth20/userinfo
  jwks_uri: https://api.bmo.com/aac/sps/oauth/oauth20/jwks/VerifymeOIDC
  introspection_endpoint: https://api.bmo.com/aac/sps/oauth/oauth20/introspect
  revocation_endpoint: https://api.bmo.com/aac/sps/oauth/oauth20/revoke
  id_token_signing_alg_values_supported: [RS256]
  response_types_supported: [code, none]
  grant_types_supported: [urn:ietf:params:oauth:grant-type:jwt-bearer, authorization_code]
  sources: [well-known/bank-of-montreal-openid-configuration.json]
- name: Encryption
  type: message-encryption
  description: >-
    The BMO Encryption API encrypts all requests to and responses from BMO APIs;
    encryption is mandatory for the Payment APIs and for fields shared via the
    Account Validation API. This is an application-layer requirement on top of
    OAuth 2.0 transport auth.
  sources: [https://developer.bmo.com/api/commercial/product]