Mettle · Authentication Profile

Mettle Authentication

Authentication

Mettle secures its APIs with oauth2, openIdConnect, and mutualTLS across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

Financial-ServicesBankingBusiness BankingOpen BankingPSD2OBIEFAPIUnited KingdomPaymentsAccount InformationChallenger BankFintech
Methods: oauth2, openIdConnect, mutualTLS Schemes: 3 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in:

Security Schemes

OpenBankingOAuth2 oauth2
· flows: authorizationCode, clientCredentials
OpenIDConnect openIdConnect
MutualTLS mutualTLS

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-23'
method: searched
source: >-
  https://secure1.natwest.com/.well-known/openid-configuration (NatWest Group
  Open Banking OpenID Provider) + OBIE FAPI Read/Write security profile
docs: https://www.bankofapis.com/products/accounts/documentation/mettle
notes: >-
  The public Open Data (Product) API is unsecured (no credentials required to read
  reference data). The Read/Write family (AIS/PIS/CBPII) is FAPI-secured against the
  shared NatWest Group OpenID Provider. Onboarding requires OBIE/eIDAS OB Transport
  and Signing certificates issued via the OpenBanking Directory and registration
  through the Bank of APIs portal.
summary:
  types: [oauth2, openIdConnect, mutualTLS]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
  open_data_api: unsecured
  fapi: true
  psd2_sca: true
provider:
  issuer: https://secure1.natwest.com
  authorization_endpoint: https://secure1.natwest.com/as/authorization.oauth2
  token_endpoint: https://secure1t.natwest.com/as/token.oauth2
  revocation_endpoint: https://secure1.natwest.com/as/revoke_token.oauth2
  registration_endpoint: https://api.natwest.com/register/v1.0
  jwks_uri: https://keystore.openbanking.org.uk/0015800000jfwxXAAQ/6htRg5BcPIKPQEMSacgHjn.jwks
schemes:
- name: OpenBankingOAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://secure1.natwest.com/as/authorization.oauth2
    tokenUrl: https://secure1t.natwest.com/as/token.oauth2
    use: AIS/PIS/CBPII customer-consent access (accounts, payments, fundsconfirmations)
  - flow: clientCredentials
    tokenUrl: https://secure1t.natwest.com/as/token.oauth2
    use: TPP client access-token acquisition prior to consent
  applies_to: [aisp, pisp, cbpii]
- name: OpenIDConnect
  type: openIdConnect
  response_types: [code id_token]
  id_token_signing_alg: [PS256, RS256, ES256]
  request_object_signing_alg: [PS256, RS256, ES256]
  acr_values: ['urn:openbanking:psd2:ca', 'urn:openbanking:psd2:sca']
  claims: [openbanking_intent_id, acr, sub, iss, aud, exp, iat]
  note: FAPI hybrid flow; request object is a signed JWT carrying openbanking_intent_id
- name: MutualTLS
  type: mutualTLS
  token_endpoint_auth_methods: [tls_client_auth, private_key_jwt]
  note: >-
    OBIE/eIDAS OB Transport certificate for the mTLS channel; OB Signing
    certificate for detached JWS message signing on write operations.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/mettle-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.