Register
API Explorer
https://obp-api-sandbox.nmbbank.co.tz

Authentication: OAuth 2

OAuth2 is allowed on this instance.

OAuth2 / OpenID Connect (OIDC) is the recommended authentication method for production use.

OBP supports the OAuth2 Authorization Code flow for user-facing applications and the Client Credentials flow for application-only (machine-to-machine) access.

Authorization Code Flow (3-legged)

Use this flow when your application needs to act on behalf of a user.

  1. Read the registration instructions at https://obp-portal-sandbox.nmbbank.co.tz/developers/consumer-creation, log in and proceed to https://obp-portal-sandbox.nmbbank.co.tz/consumers/register to register your application and obtain a client_id and client_secret.

  2. Redirect the user to the authorization URL with your client_id and redirect_uri.

  3. After the user authenticates and consents, they are redirected back with an authorization code.

  4. Exchange the authorization code for an access token at the token endpoint.

  5. Use the access token as a Bearer token in the Authorization header:

    GET https://obp-api-sandbox.nmbbank.co.tz/obp/v7.0.0/my/banks
Authorization: Bearer your-access-token

Client Credentials Flow (2-legged / Application Only)

Use this flow for endpoints with authMode ApplicationOnly or UserOrApplication. The application authenticates itself using its client_id and client_secret without a user login.

POST https://obp-oauth2-sandbox.nmbbank.co.tz/obp-oidc/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET

The response contains a Bearer token to use in subsequent API calls.

Notes

  • The authorization and token endpoint URLs depend on the OIDC provider configured for this OBP instance.
  • OIDC discovery endpoint: https://obp-oauth2-sandbox.nmbbank.co.tz/obp-oidc/.well-known/openid-configuration (contains token_endpoint, authorization_endpoint, and jwks_uri).
  • All configured discovery URIs can be queried via: GET https://obp-api-sandbox.nmbbank.co.tz/obp/v5.1.0/well-known
  • Token expiry and refresh behaviour depend on the OIDC provider configuration.
  • OAuth2 / OIDC is the recommended method for production deployments.

<img src="https://static.openbankproject.com/images/OBP-OAuth2-flow.png" width="885"></img>

An example Consent Testing App (Hola) using this flow can be found here