specification: API Commons Authentication specificationVersion: '0.1' provider: Deutsche Bank providerId: deutsche-bank generated: '2026-09-06' method: searched source: https://developer.db.com/apidocumentation/oauthflows/oauthintroduction derived_from: openapi/ (36 first-party OpenAPI 3.0.x documents, components.securitySchemes) docs: https://developer.db.com/apidocumentation/oauthflows/oauthintroduction description: >- Deutsche Bank's dbAPI programme is an OAuth 2.0 / OpenID Connect estate. Every dbAPI operation is protected by one of three named OAuth 2.0 security schemes declared in the specs, and the Merchant Solutions REST APIs use a bearer JWT minted by their own security API. There is no API-key path onto customer data: the portal API key is only used by the developer portal itself to read the public swagger catalogue. identity_providers: - name: dbAPI OAuth / OIDC provider (simulation) issuer: https://simulator-api.db.com/gw/oidc/ discovery: https://simulator-api.db.com/gw/oidc/.well-known/openid-configuration file: well-known/deutsche-bank-simulator-openid-configuration.json status: 200 - name: Deutsche Bank corporate CIAM (ForgeRock AM) - developer portal login issuer: https://cidp-eu.db.com/am/oauth2/global discovery: https://cidp-eu.db.com/am/oauth2/global/.well-known/openid-configuration file: well-known/deutsche-bank-cidp-openid-configuration.json status: 200 production_hosts: - tenant: Deutsche Bank base: https://api.db.com - tenant: norisbank base: https://api.norisbank.de - tenant: Postbank base: https://api.postbank.de sandbox_host: https://simulator-api.db.com schemes: - name: api_auth_code type: oauth2 flow: authorizationCode authorizationUrl: https://simulator-api.db.com/gw/oidc/oauth2/authorize tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token description: >- End-user delegated access. Used by the customer-data APIs - accounts, transactions, credit cards, addresses, partners, investments, payments. PKCE (S256) is supported and documented as a separate guide; code_challenge_methods_supported is ["S256"]. applies_to: - dbapi-addresses-v2 - dbapi-ageCertificate-v1 - dbapi-cashAccounts-v2 - dbapi-creditCards-v1 - dbapi-creditCardTransactions-v1 - dbapi-customerSolvency-v1 - dbapi-investments-assets-v1 - dbapi-investments-earningTransactions-v1 - dbapi-investments-orders-v1 - dbapi-investments-performances-v1 - dbapi-investments-reports-v1 - dbapi-investments-securityAccounts-v1 - dbapi-investments-securityTransactions-v1 - dbapi-partners-v2 - dbapi-payments-sepaInstantCreditTransfer-v3 - dbapi-sepaCreditTransfer-v3 - dbapi-sepaDirectDebit-v1 - dbapi-subscriptions-v1 - dbapi-transactionAnalysis-v1 - dbapi-transactionAuthorization-v1 - dbapi-transactions-v2 - dbapi-verifyCustomer-v1 - name: api_client_credential type: oauth2 flow: clientCredentials tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token description: >- Machine-to-machine access for the onboarding, lending and processing surfaces where no end user is present in the request. applies_to: - dbapi-banking-cashAccountOpenings-v1 - dbapi-investments-espSecuritiesAccounts-v1 - dbapi-loanOffers-privatebanking-v1 - dbapi-loanOffers-privatebanking-v2 - dbapi-processingOrders-v1 - dbapi-processingOrders-v2 - name: api_db_smart_access type: oauth2 flow: clientCredentials tokenUrl: https://simulator-api.db.com/gw/oidc/oauth2/token description: >- db Smart Access - the corporate product where authorisation is bound to the onboarding contract rather than to a per-request customer consent. Release 2026.03 moved this product onto a technical OAuth2 client-credentials flow with annual recertification. applies_to: - dbapi-cashAccounts-v2 - dbapi-creditCards-v1 - dbapi-creditCardTransactions-v1 - dbapi-investments-assets-v1 - dbapi-investments-earningTransactions-v1 - dbapi-investments-performances-v1 - dbapi-investments-reports-v1 - dbapi-investments-securityAccounts-v1 - dbapi-investments-securityTransactions-v1 - dbapi-payments-sepaInstantCreditTransfer-v3 - dbapi-sepaCreditTransfer-v3 - dbapi-sepaDirectDebit-v1 - dbapi-subscriptions-v1 - dbapi-transactionAuthorization-v1 - dbapi-transactions-v2 - name: bearerAuth type: http scheme: bearer bearerFormat: JWT description: >- Merchant Solutions REST APIs and the OneID contract. The Merchant-Server II Security API (POST /token) mints the JWT that the Services API then consumes. applies_to: - merchant-solution-services-v2 - merchant-solution-services-v2.1 - merchant-solution-security-v2 - oneid-fakerock-v1 grant_types: - authorization_code - authorization_code + PKCE (S256) - client_credentials - refresh_token - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:token-exchange client_authentication: - client_secret_basic - client_secret_post - client_secret_jwt - private_key_jwt - tls_client_auth - self_signed_tls_client_auth mutual_tls: supported: true note: >- The dbAPI OIDC discovery document advertises tls_client_auth and self_signed_tls_client_auth, and tls_client_certificate_bound_access_tokens is true. The portal documents this as "Certificate based Authentication". docs: https://developer.db.com/apidocumentation/oauthflows/certificates step_up: present: true mechanism: >- Strong customer authentication (PSD2 SCA) is a first-class API surface. The Transaction Authorization API issues and verifies challenges (PushTAN and other methods), and payment and investment write operations carry an OTP request header that carries the second factor. api: dbapi-transactionAuthorization-v1 headers: - OTP - otp scopes: scopes/deutsche-bank-scopes.yml common_headers: - name: Correlation-Id required_on: every operation in the dbAPI estate description: Caller-supplied correlation identifier for request tracing. - name: idempotency-id format: uuid description: Replay-protection key on the write surfaces that support it. See conventions/. maintainers: - FN: Kin Lane email: kin@apievangelist.com