Consumer, Consent, Transport and Payload Security - Glossary

| |Consumer, Consent, Transport and Payload Security with MTLS and JWS |This glossary item aims to give an overview of how the communication between an Application and the OBP API server is secured with Consents, Consumer records, MTLs and JWS. | |It includes some implementation step notes for the Application developer. | |The following components are required: | |## Consumer record | |The Application must have an active API Consumer / Client record on the server. | |## MTLS | |With Mutual TLS both the Consumer and the Server (OBP API) must use certificates. | |## JWS | |The Request is signed by the Consumer with a JWS using the client certificate of the Consumer. Example: OBP-Hola private void requestIntercept |The Request is verified by the OBP API Server using the JWS provided by the Consumer. See OBP-API def verifySignedRequest |The Response is signed by the OBP API Server with a JWS. See OBP-API def signResponse |The Response is verified by the Client using the JWS provided by the OBP API Server. Example: OBP-Hola private void responseIntercept | | |## Consent | |The end user must give permission to the Application in order for the Application to see his/her account and transaction data. | |<img width="468" alt="obp-permission-transport-and-payload-security" src="https://user-images.githubusercontent.com/485218/114748431-38c13f80-9d52-11eb-9e54-50633a0ee601.png"></img> | |## In order to get an App / Consumer key | |Sign up or login as a developer. | |Register your App / Consumer HERE | |Be sure to enter your Client Certificate in the registration form. To create the user.crt file see HERE | | |## Authenticate | |To test the service your App will need to authenticate using OAuth2. | |You can use the OBP Hola App as an example / starting point for your App. |