Northmill Authentication

generated: '2026-08-26'
method: searched
source: >-
  openapi/northmill-flo-api-swagger.json (securityDefinitions) plus the Northmill Bank
  TPP documentation at
  https://developer.token.io/northmill_rest_api_doc/content/e-rest/signing_and_authentication.htm
  and .../content/0_-_common/request-headers.htm, read 2026-08-26. Upgraded from the
  derived spec-only profile.
docs:
  - https://api.moreflo.com/swagger/ui/index
  - https://developer.token.io/northmill_rest_api_doc/content/e-rest/signing_and_authentication.htm
  - https://developer.token.io/northmill_rest_api_doc/content/0_-_common/request-headers.htm
description: >-
  Two surfaces, two authentication models. The Flo commerce API is HTTP Basic and
  nothing else. The PSD2 TPP interface is request-signing with an asymmetric key pair
  the TPP registers in the Northmill Bank Dashboard, carried on an Authorization header
  in either a Token (Basic) or JWT (Bearer) scheme.
summary:
  types:
    - http
  oauth2: false
  openid_connect: false
  mtls_documented_for_flo: false
schemes:
  - name: basic
    api: Northmill Flo API
    type: http
    scheme: basic
    description: Basic HTTP Authentication
    sources:
      - openapi/northmill-flo-api-swagger.json
    credential_issuance:
      self_service: false
      console: https://apps.moreflo.com/
      note: >-
        Credentials are issued from the Flo back office. There is no key-creation
        endpoint, no key rotation endpoint and no test/live key prefix - the sandbox is
        a separate host (https://test.api.moreflo.com), not a separate key namespace.
    applied_to: >-
      Declared once at the document level. Every one of the 199 operations requires it -
      an unauthenticated GET /health returns HTTP 401 with a Basic challenge
      (probed 2026-08-26).
    scopes: none - there is no scope, role or permission model in the contract
  - name: tpp-request-signing
    api: Northmill Bank Open Banking API for TPPs
    type: http
    schemes_accepted: [Basic (Token authentication), Bearer (JWT authentication)]
    header: Authorization
    key_algorithms: [ES256, RS256]
    key_registration: >-
      The TPP generates a key pair (the docs give the exact openssl commands for
      secp521r1/ES256 and RSA-2048/RS256), base64url-encodes the public key and uploads
      it to the Northmill Bank Dashboard. Requests are then signed with the private key.
    identity:
      member_id: unique value generated by the Dashboard at signup
      alias: unique email or domain generated at signup (types DOMAIN, EMAIL, other)
      note: The docs recommend sending both to avoid a typo-induced mismatch.
    certificate: >-
      "TPPs must send a set of HTTP headers that allow the bank to check the request's
      validity. This includes signing the request with a qualified certificate."
      (eIDAS-style qualified certificate, per PSD2 RTS.)
    additional_headers:
      customer-initiated: >-
        boolean - declares the call was explicitly initiated by the PSU, which exempts
        it from the RTS four-per-24-hours TPP-initiated access cap.
      token-customer-ip-address: >-
        the PSU's IP; supplying it implies PSU presence.
      token-customer-last-logged-time: when the PSU last logged in with the TPP
      token-customer-device-id: PSU device identifier
      token-customer-user-agent: PSU user agent
      request-timeout: integer seconds before the call aborts with DEADLINE_EXCEEDED
      token-json-error: boolean - render errors as JSON
gaps:
  - No OAuth 2.0 or OpenID Connect anywhere; /.well-known/openid-configuration and /.well-known/oauth-authorization-server both 404.
  - No scope or permission model on the Flo API - a Basic credential is all-or-nothing across all 199 operations.
  - No documented key rotation, expiry or revocation procedure for Flo credentials.
  - Basic auth transmits a reusable secret on every request; there is no signed-request option on the commerce API.