OAuth
OAuth (Open Authorization) is an industry-standard authorization framework that allows third-party applications to access user-specific resources on a service provider's platform on behalf of the user. The user never shares credentials directly; instead, the framework issues time-limited access tokens after the user grants explicit consent.
OAuth addresses a fundamental security problem in API access: how does a third-party application access a user's data or perform actions on their behalf without the user giving that application their password? OAuth solves this through a consent flow: the user authorizes the third party, the service provider issues an access token, and the third party uses that token for subsequent API calls without ever handling the user's credentials.
In the payment context, OAuth is used in open banking integrations, where a payment initiation service provider requests access to a user's bank account to initiate a payment. The bank authenticates the user, the user consents to the specific access requested, and the bank issues a time-limited token. The payment service provider uses this token to initiate the payment without ever handling the user's banking credentials.
For machine-to-machine API integrations, such as a platform accessing Nium's APIs on behalf of itself, API key authentication is typically more appropriate than OAuth. OAuth is most valuable where user-delegated consent is required, particularly in open banking and account information service use cases where data access must be explicitly authorized by the account holder.
OAuth enables secure delegated access without credential sharing, a critical security property for open banking and third-party API integrations. When a payment service provider initiates a payment from a user's bank account, OAuth ensures the user explicitly authorized that specific action, with the access token scoped to the requested permissions and expiring after a defined period.
- OAuth consent flows add friction to user journeys: each new authorization requires user interaction
- Token refresh management adds integration complexity
- Scope management ensures tokens carry only required permissions
- OAuth implementation varies between identity providers, creating integration challenges
- Token revocation must be handled gracefully when users withdraw consent
A business expense management platform integrates open banking payment initiation via OAuth to allow users to pay supplier invoices directly from their business bank account. Users authenticate with their bank via OAuth, grant consent for payment initiation, and the platform initiates payments using the access token. Payment initiation conversion improves by 23% versus the previous redirect-to-bank-portal approach.
Related Concepts
Nium's API platform supports OAuth 2.0 for use cases requiring user-delegated access authorization. For direct platform-to-Nium integrations, API key authentication is the standard approach. Nium's developer documentation provides implementation guidance for both authentication patterns.
Answers you didn't know you needed.
What does OAuth stand for?
OAuth stands for Open Authorization. The current version is OAuth 2.0, which is the standard used in modern API authorization flows.
What is the difference between authentication and authorization?
Authentication verifies who you are (proving your identity). Authorization determines what you are allowed to do (what resources you can access). OAuth handles authorization, granting access to specific resources, while authentication is handled separately by the identity provider.
What is an OAuth access token?
An access token is a credential issued by an OAuth authorization server after successful consent. The third-party application includes this token in API requests to prove it has been granted access. Tokens have expiry times and scopes defining what they can access.
What is the difference between OAuth and API keys?
API keys identify the application making the request. OAuth authorizes the application to act on behalf of a specific user. Use API keys for server-to-server platform integration; use OAuth when individual user authorization is required.
Is OAuth used in open banking?
Yes. Open banking standards (PSD2 in Europe, Open Banking in the UK) mandate OAuth as the authorization mechanism for payment initiation and account information services.