Nopan · Authentication Profile

Nopan Authentication

Authentication

Nopan uses OAuth2 client_credentials machine-to-machine authentication layered over mutual TLS (mTLS), with every request additionally signed using JWS. The OpenAPI definition documents these in prose (tags and the /auth/token operation) rather than a formal components.securitySchemes block, so this profile is captured from the auth guide and the token operation.

Nopan secures its APIs with oauth2, mutualTLS, http-bearer, and jws-signing across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

PaymentsPayment Service ProviderAccount to AccountWallet PaymentsOpen BankingPSD2FintechEuropeTokenizationRecurring Payments
Methods: oauth2, mutualTLS, http-bearer, jws-signing Schemes: 4 OAuth flows: clientCredentials API key in:

Security Schemes

OAuth2ClientCredentials oauth2
MutualTLS mutualTLS
BearerToken http
scheme: bearer
JWSRequestSigning message-signature

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: https://docs.nopan.com/guides/authentication
docs: https://docs.nopan.com/guides/authentication
description: >-
  Nopan uses OAuth2 client_credentials machine-to-machine authentication layered
  over mutual TLS (mTLS), with every request additionally signed using JWS. The
  OpenAPI definition documents these in prose (tags and the /auth/token operation)
  rather than a formal components.securitySchemes block, so this profile is captured
  from the auth guide and the token operation.
summary:
  types: [oauth2, mutualTLS, http-bearer, jws-signing]
  oauth2_flows: [clientCredentials]
  api_key_in: []
schemes:
  - name: OAuth2ClientCredentials
    type: oauth2
    flow: clientCredentials
    token_url: https://api.nopan.io/auth/token
    grant_type: client_credentials
    client_id: organization account ID issued at onboarding
    token_type: Bearer (JWT, ES256)
    default_scope: payments:read
    scopes: [payments:read, payments:process]
    source: openapi/nopan-openapi-original.yml#getAccessToken
  - name: MutualTLS
    type: mutualTLS
    description: Client certificate required on the TLS handshake for all requests (mTLS).
  - name: BearerToken
    type: http
    scheme: bearer
    bearer_format: JWT
    description: Access token from /auth/token presented as Authorization Bearer on protected resources.
  - name: JWSRequestSigning
    type: message-signature
    description: Every request is signed with JWS (JSON Web Signature) and validated server-side.