Before you can request OAuth tokens, you need to create an OAuth application for your institution. This gives you the client ID you will use in the next authentication step.

​
Step 1: Open the OAuth apps page

Sign in to the dashboard and open the OAuth section for your institution. This is where you manage the apps that can request tokens on your behalf. Institution OAuth flow

​
Step 2: Start a new app

Create a new OAuth application from this page. Use a clear app name so your team can recognize it later. Create OAuth application

​
Step 3: Generate and add your public key

Click the information icon beside X509 Public Key to see how to generate the public key. Copy and run the commands below in a terminal or command prompt to generate your private key and public key certificate. Enter the required information when prompted and save the generated keys in a secure directory for later use. Private key: 
openssl genrsa -out privatekey.pem 1024
Public key: 
openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 1825
After you create your public key in the terminal, paste it into the public key field and click Add Application to create the app. When the application is created, Cardcore takes you to the app details page. From there, you can copy your OAuth client ID and update the other app details.

​
App details

These are the fields you provide when you create an OAuth application.
​
name
string
required
The name your team will use to recognize this app.Use a clear name, for example Mobile Banking App or Core Banking Service.
​
description
string
A short note that explains what this app is for.
​
publicKey
string
required
The certificate public key for this app.Paste the content of the public key certificate you generated for the app. Keep the matching private key safe and do not share it.
​
scopes
array
required
The permissions this app should have.For example, READ lets the app read allowed information, while WRITE lets it perform allowed actions.
​
grantType
string
required
How this app will request access.Use client_credentials for server-to-server access. Use authorization_code when a user must approve access.
​
redirectUri
array
The web addresses the system can send users back to after they approve access.This is required when grantType is authorization_code.
​
websiteUrl
string
The website for this app or business.
​
iconUrl
string
A link to the app’s logo or icon.
​
isOfficial
boolean
Set this to true if this is an official app owned by your institution.

​
Step 4: Save the app and copy the client ID

Get OAuth client ID After you save the app, open the app details page and copy the client ID. You will use this value as {{OAuth Institution Client ID}} when you build your client assertion.

​
Next step

After you copy the client ID, continue to Signing your client assertion.