Deutsche Bank Authentication

specification: API Commons Authentication
specificationVersion: '0.1'
provider: Deutsche Bank
providerId: deutsche-bank
generated: '2026-09-06'
method: searched
source: https://developer.db.com/apidocumentation/oauthflows/oauthintroduction
derived_from: openapi/ (36 first-party OpenAPI 3.0.x documents, components.securitySchemes)
docs: https://developer.db.com/apidocumentation/oauthflows/oauthintroduction
description: >-
  Deutsche Bank's dbAPI programme is an OAuth 2.0 / OpenID Connect estate. Every dbAPI
  operation is protected by one of three named OAuth 2.0 security schemes declared in the
  specs, and the Merchant Solutions REST APIs use a bearer JWT minted by their own security
  API. There is no API-key path onto customer data: the portal API key is only used by the
  developer portal itself to read the public swagger catalogue.
identity_providers:
  - name: dbAPI OAuth / OIDC provider (simulation)
    issuer: https://simulator-api.db.com/gw/oidc/
    discovery: https://simulator-api.db.com/gw/oidc/.well-known/openid-configuration
    file: well-known/deutsche-bank-simulator-openid-configuration.json
    status: 200
  - name: Deutsche Bank corporate CIAM (ForgeRock AM) - developer portal login
    issuer: https://cidp-eu.db.com/am/oauth2/global
    discovery: https://cidp-eu.db.com/am/oauth2/global/.well-known/openid-configuration
    file: well-known/deutsche-bank-cidp-openid-configuration.json
    status: 200
production_hosts:
  - tenant: Deutsche Bank
    base: https://api.db.com
  - tenant: norisbank
    base: https://api.norisbank.de
  - tenant: Postbank
    base: https://api.postbank.de
sandbox_host: https://simulator-api.db.com
schemes:
  - name: api_auth_code
    type: oauth2
    flow: authorizationCode
    authorizationUrl: https://simulator-api.db.com/gw/oidc/oauth2/authorize
    tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token
    description: >-
      End-user delegated access. Used by the customer-data APIs - accounts, transactions,
      credit cards, addresses, partners, investments, payments. PKCE (S256) is supported and
      documented as a separate guide; code_challenge_methods_supported is ["S256"].
    applies_to:
      - dbapi-addresses-v2
      - dbapi-ageCertificate-v1
      - dbapi-cashAccounts-v2
      - dbapi-creditCards-v1
      - dbapi-creditCardTransactions-v1
      - dbapi-customerSolvency-v1
      - dbapi-investments-assets-v1
      - dbapi-investments-earningTransactions-v1
      - dbapi-investments-orders-v1
      - dbapi-investments-performances-v1
      - dbapi-investments-reports-v1
      - dbapi-investments-securityAccounts-v1
      - dbapi-investments-securityTransactions-v1
      - dbapi-partners-v2
      - dbapi-payments-sepaInstantCreditTransfer-v3
      - dbapi-sepaCreditTransfer-v3
      - dbapi-sepaDirectDebit-v1
      - dbapi-subscriptions-v1
      - dbapi-transactionAnalysis-v1
      - dbapi-transactionAuthorization-v1
      - dbapi-transactions-v2
      - dbapi-verifyCustomer-v1
  - name: api_client_credential
    type: oauth2
    flow: clientCredentials
    tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token
    description: >-
      Machine-to-machine access for the onboarding, lending and processing surfaces where no
      end user is present in the request.
    applies_to:
      - dbapi-banking-cashAccountOpenings-v1
      - dbapi-investments-espSecuritiesAccounts-v1
      - dbapi-loanOffers-privatebanking-v1
      - dbapi-loanOffers-privatebanking-v2
      - dbapi-processingOrders-v1
      - dbapi-processingOrders-v2
  - name: api_db_smart_access
    type: oauth2
    flow: clientCredentials
    tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token
    description: >-
      db Smart Access - the corporate product where authorisation is bound to the onboarding
      contract rather than to a per-request customer consent. Release 2026.03 moved this
      product onto a technical OAuth2 client-credentials flow with annual recertification.
    applies_to:
      - dbapi-cashAccounts-v2
      - dbapi-creditCards-v1
      - dbapi-creditCardTransactions-v1
      - dbapi-investments-assets-v1
      - dbapi-investments-earningTransactions-v1
      - dbapi-investments-performances-v1
      - dbapi-investments-reports-v1
      - dbapi-investments-securityAccounts-v1
      - dbapi-investments-securityTransactions-v1
      - dbapi-payments-sepaInstantCreditTransfer-v3
      - dbapi-sepaCreditTransfer-v3
      - dbapi-sepaDirectDebit-v1
      - dbapi-subscriptions-v1
      - dbapi-transactionAuthorization-v1
      - dbapi-transactions-v2
  - name: bearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      Merchant Solutions REST APIs and the OneID contract. The Merchant-Server II Security API
      (POST /token) mints the JWT that the Services API then consumes.
    applies_to:
      - merchant-solution-services-v2
      - merchant-solution-services-v2.1
      - merchant-solution-security-v2
      - oneid-fakerock-v1
grant_types:
  - authorization_code
  - authorization_code + PKCE (S256)
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
client_authentication:
  - client_secret_basic
  - client_secret_post
  - client_secret_jwt
  - private_key_jwt
  - tls_client_auth
  - self_signed_tls_client_auth
mutual_tls:
  supported: true
  note: >-
    The dbAPI OIDC discovery document advertises tls_client_auth and
    self_signed_tls_client_auth, and tls_client_certificate_bound_access_tokens is true. The
    portal documents this as "Certificate based Authentication".
  docs: https://developer.db.com/apidocumentation/oauthflows/certificates
step_up:
  present: true
  mechanism: >-
    Strong customer authentication (PSD2 SCA) is a first-class API surface. The Transaction
    Authorization API issues and verifies challenges (PushTAN and other methods), and payment
    and investment write operations carry an OTP request header that carries the second
    factor.
  api: dbapi-transactionAuthorization-v1
  headers:
    - OTP
    - otp
scopes: scopes/deutsche-bank-scopes.yml
common_headers:
  - name: Correlation-Id
    required_on: every operation in the dbAPI estate
    description: Caller-supplied correlation identifier for request tracing.
  - name: idempotency-id
    format: uuid
    description: Replay-protection key on the write surfaces that support it. See conventions/.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com