Starling Bank · Authentication Profile

Starling Bank Authentication

Authentication

Starling Bank secures its APIs with oauth2 and http across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and personal_access_token flow(s).

Financial-ServicesBankingOpen BankingPSD2OBIEUnited KingdomPaymentsAccount InformationChallenger BankFintechFAPI

Methods: oauth2, http Schemes: 3 OAuth flows: authorizationCode, personal_access_token API key in:

Security Schemes

BespokeOAuth2 oauth2

· flows: authorizationCode, personal_access_token

BearerToken http

scheme: bearer

OpenBankingFAPI oauth2

Source

Authentication Profile

generated: '2026-07-23'
method: searched
source: https://api.starlingbank.com/.well-known/oauth-authorization-server + https://developer.starlingbank.com/docs + live 401 probe
docs: https://developer.starlingbank.com/docs
summary:
  types: [oauth2, http]
  http_scheme: bearer
  oauth2_flows: [authorizationCode, personal_access_token]
  surfaces:
  - bespoke Developer API (api.starlingbank.com) — OAuth2 bearer
  - Open Banking Read/Write (AIS/PIS/CBPII) — FAPI OAuth2/OIDC + mutual-TLS + PSD2 SCA
schemes:
- name: BespokeOAuth2
  type: oauth2
  applies_to: Starling bespoke Developer API (api.starlingbank.com/api/v2)
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.starlingbank.com
    tokenUrl: https://token-api.starlingbank.com/oauth/access-token
    issuer: https://token-api.starlingbank.com
    response_types_supported: [code, token]
  - flow: personal_access_token
    note: Sandbox and read-only integrations can mint a personal access token in the
      developer portal instead of running the full authorization-code flow.
  evidence: RFC 8414 metadata at api.starlingbank.com/.well-known/oauth-authorization-server;
    unauthenticated GET /api/v2/accounts returns 401 {"error":"invalid_token"} requiring
    an Authorization bearer header.
- name: BearerToken
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: All bespoke Developer API calls carry Authorization Bearer access tokens.
- name: OpenBankingFAPI
  type: oauth2
  applies_to: OBIE Read/Write (AIS/PIS/CBPII) as an FCA-authorised ASPSP
  profile: FAPI 1.0 Advanced
  client_authentication: mutual-TLS (eIDAS/OBIE certificates)
  strong_customer_authentication: PSD2 SCA (redirect / app-to-app)
  note: Provisioned to enrolled, certificate-holding TPPs; not publicly probeable.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/starling-bank-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.