There are two token types:

• application authentication tokens;
• and consent tokens.

For testing purposes and the proper usage of our sandbox the valid tokens can be generated on your side via the dedicated sandox token generator endpoint after the finalization of your registration.

Tokens expire and must be renewed after a certain time period. The TPP receives an error message if the token used is expired.

application authentication token

An application authentication token is used for the identification of the TPP’s application:

• when K&H’s API is used;
• upon redirection to the K&H redirection screen for customer authentication.

obtaining an application authentication token

Creating an application is necessary to use our APIs. An application authentication token can be obtained when the application is registered. For testing purposes application and other tokens to be used are generated for you after finalization of your registration. 

renewing or regenerating an application authentication token

Use the unique application ID to request a new application authentication token through the relevant API, in case you your application authentication token has expired or receives “token unknown” as a response. 

consent tokens

At least one token is connected to each consent. This token must be used for the operations requiring the consent. A consent token also identifies the application creating that consent; so if that token is used, it is not necessary to use the application authentication token as well.

obtaining a consent token

The response of the API used to query the consent status contains the consent token (the token field in the header) if the consent status is “valid”.

renewing or regenerating a consent token

A consent token is renewed in the same way that it is obtained because the API used to query the consent status creates a new token upon every call if the consent status is „valid”. This can be used in case your application authentication token has expired or receives “token unknown” as a response. 

which kind of token you can use for which API endpoint