Key Terminology Glossary

Introduction

This glossary provides plain-English definitions for technical terms you'll encounter when working with Open Banking and the Moneyhub API. Terms are organized alphabetically.

Usage: Bookmark this page and refer back to it whenever you encounter an unfamiliar term.

A

Access Token

A credential used to access protected resources (APIs). Think of it as a temporary key that grants permission to read data or perform actions.

Format: JWT (JSON Web Token)
Lifespan: Short (typically 1 hour)
Use: Include in the Authorisation header when calling APIs

Example:

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Related: Token, ID Token, Refresh Token

Account Information Service Provider (AISP)

A type of Third Party Provider (TPP) authorized to access users' bank account information. AISPs can read data but cannot initiate payments.

Examples: Budgeting apps, financial aggregators, tax calculators

Moneyhub's role: Moneyhub is a regulated AISP

Related: PISP, TPP

Account Servicing Payment Service Provider (ASPSP)

A bank or building society that provides and maintains payment accounts. In Open Banking, this is simply "the bank."

What they do:

Hold customer accounts
Provide Open Banking APIs
Authenticate users
Process payments

Related: Open Banking

API (Application Programming Interface)

A set of defined methods and protocols that allow different software applications to communicate with each other.

In Open Banking: APIs let your application request data or initiate payments programmatically.

Example: Moneyhub provides APIs to access bank data and make payments.

Related: REST API, Endpoint

API Client

Your application's configuration and credentials registered with Moneyhub. Each client has a unique ID, redirect URIs, and cryptographic keys.

Created in: Moneyhub Admin Portal
Contains: Client ID, JWKS, redirect URIs, scopes, algorithms

Related: Client ID, JWKS

Authentication

The process of verifying identity (who you are). Different from authorisation (what you are allowed to do).

Example: Proving your client identity to the token endpoint using a JWT or client credentials.

Related: Authorisation, Consent

Authorisation

The process of granting permission to access resources or perform actions. Different from authentication (proving identity).

Example: "I authorise Moneyhub to read my transactions for 90 days"

Related: Authentication, Consent

Authorisation Code

A temporary code issued after user consent that can be exchanged for tokens. Single-use and short-lived (typically 60 seconds).

Flow:

User grants consent
Bank issues authorisation code
Your app exchanges code for tokens
Code becomes invalid

Security: Even if intercepted, the code is useless without client credentials.

Authorisation Code Flow

The OAuth 2.0 flow used in Open Banking where:

User is redirected to authorise
Authorisation code is returned
Code is exchanged for tokens

Why this flow: Most secure for web and mobile applications.

Related: OAuth 2.0, PKCE

Authorisation Server

The server that handles authentication and issues tokens. In the Moneyhub ecosystem, this is the Moneyhub Identity Service.

URL: https://identity.moneyhub.co.uk

Responsibilities:

Validates authorisation requests
Coordinates with banks
Issues access and ID tokens
Manages consent

Related: Resource Server

Authorisation URL

The URL that users visit to grant consent. Contains all the information about what you're requesting.

Format:

https://identity.moneyhub.co.uk/oidc/auth?
  request_uri=urn:ietf:params:oauth:request_uri:abc123

Created by: Your application (via Moneyhub SDK or API)

Related: PAR, Request Object

B

Bank ID

A unique identifier for a specific financial institution in the Moneyhub system.

Examples:

hsbc - HSBC
barclays - Barclays
test - Test banks

Where to find: All Connections endpoint

Use: Specify in the scope (e.g., id:hsbc) to skip bank selection.

Related: Scope

Bearer Token

A type of access token sent in the Authorisation header with the prefix "Bearer".

Example:

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Related: Access Token

C

Claim

Specific pieces of information requested in an authorisation flow. Claims can be about the user or specify action details (like payment amounts).

Format: JSON object nested under id_token or userinfo

Example:

{
  "id_token": {
    "mh:payment": {
      "essential": true,
      "value": {
        "amount": 1000,
        "payeeId": "payee-123"
      }
    }
  }
}

Related: Scope, ID Token

Client Assertion

A JWT signed by your private key used to authenticate your application when requesting tokens. Replaces client secrets for improved security.

Format: JWT with claims: iss, sub, aud, iat, exp, jti

Algorithm: RS256, ES256, or PS256 (configured in client)

Use: Sent in token requests to prove your identity

Related: Private Key JWT, JWT

Client Credentials Grant

An OAuth 2.0 grant type for server-to-server authentication without user interaction.

Use in Moneyhub:

Creating payees
Managing users
Administrative tasks

Example:

const token = await moneyhub.getClientCredentialToken({
  scope: 'payee:create'
});

Related: Grant Type

Client ID

A unique identifier for your API client. Public and non-secret.

Format: UUID (e.g., 855774b1-cb57-4d61-8fbd-aebafbbd79f7)

Where to find: Moneyhub Admin Portal

Use: Included in all authorisation and token requests

Related: API Client

Code Challenge

A SHA-256 hash of the code verifier, used in PKCE. Sent in the authorisation request.

Calculation:

const codeChallenge = base64URLEncode(sha256(codeVerifier));

Related: PKCE, Code Verifier

Code Verifier

A cryptographically random string (43-128 characters) used in PKCE. Sent when exchanging the authorisation code.

Security: Proves that the entity exchanging the code is the same one that initiated the authorisation.

Related: PKCE, Code Challenge

Connection

A link between a Moneyhub user and their bank account. Created when a user authorizes access to their bank.

Contains:

Bank/provider ID
Account IDs
Consent details
Expiration date

Lifetime: Typically 90 days for AIS, single-use for payments

Related: Connection ID, Consent

Connection ID

Unique identifier for a bank connection.

Format: bankId:uuid (e.g., 1ffe704d39629a929c8e293880fb449a:aa970af1-e2f5-4d23-b225-9f0b8aa14b02)

Found in: ID token claim mh:con_id

Use: Track and manage bank connections

Related: Connection

Consent

User permission for a third party to access their data or initiate payments. Must be explicit, informed, and revocable.

Includes:

What data/actions are authorized
Duration of access
Which accounts

Types:

One-time (single payment)
Ongoing (90 days for data access)
Renewable (with user re-consent)

Related: Authorisation, Scope

CSRF (Cross-Site Request Forgery)

A security attack where a malicious site tricks a user's browser into making unwanted requests.

Prevention: Use the state parameter to ensure requests originate from your application.

Related: State

D

Discovery Document

A JSON document that describes an OAuth 2.0 / OIDC provider's configuration.

Moneyhub URL: https://identity.moneyhub.co.uk/oidc/.well-known/openid-configuration

Contains:

Supported endpoints
Supported algorithms
Supported scopes
Public keys

Use: Helps clients configure themselves automatically

E

Endpoint

A specific URL that accepts API requests.

Examples:

/oidc/auth - Authorisation endpoint
/oidc/token - Token endpoint
/accounts - Accounts data endpoint

Related: API

F

FCA (Financial Conduct Authority)

The UK regulatory body overseeing financial services, including Open Banking providers.

Role: Authorizes TPPs, enforces standards, protects consumers

Related: Open Banking, TPP

G

Grant Type

The OAuth 2.0 method used to obtain tokens.

Common types:

authorization_code - For user authorisation flows
client_credentials - For server-to-server
refresh_token - For renewing access tokens

I

ID Token

A JWT containing information about the authenticated user and the authorisation. Part of OIDC.

Contains:

User ID (sub)
Audience (aud - your client ID)
Issued/expiry times
Moneyhub-specific claims (payment ID, connection ID)

Example:

{
  "sub": "user-123",
  "mh:payment": "payment-456",
  "mh:con_id": "connection-789",
  "aud": "your-client-id",
  "exp": 1234567890
}

Use: Decode to get payment/connection IDs

Related: Access Token, JWT, Claim

J

JTI (JWT ID)

A unique identifier for a JWT. Prevents token reuse.

Format: Random string

Use: Each client assertion must have a unique jti

Related: JWT, Client Assertion

JWT (JSON Web Token)

A compact, URL-safe token format consisting of three parts: header, payload, signature.

Format: header.payload.signature

Example:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIn0.
signature

Decode: Can be decoded to read the payload (don't trust without verifying signature)

Use in Moneyhub:

Access tokens
ID tokens
Client assertions
Request objects

Related: Access Token, ID Token

JWK (JSON Web Key)

A JSON representation of a cryptographic key.

Example:

{
  "kty": "RSA",
  "n": "0vx7agoebGcQSuuPiLJXZ...",
  "e": "AQAB",
  "kid": "key-id-123"
}

Related: JWKS

JWKS (JSON Web Key Set)

A set of JWKs, typically containing both public and private keys.

Public JWKS: Shared with Moneyhub (in Admin Portal)
Private JWKS: Kept secret (used to sign JWTs)

Format:

{
  "keys": [
    { "kty": "RSA", "n": "...", "e": "AQAB", "kid": "key-1" }
  ]
}

Use: Authentication via Private Key JWT

Related: JWK, Private Key JWT

M

mTLS (Mutual TLS)

A security protocol where both client and server authenticate using certificates. Some banks require this.

How it works:

Server verifies client certificate
Client verifies server certificate
Both parties authenticated

Moneyhub handling: Moneyhub manages mTLS certificates for bank connections.

Related: TLS

N

Nonce

A random value used once to prevent replay attacks.

Use:

Generate random nonce
Include in authorisation request
Verify it appears in ID token

Security: Ensures ID token was created for your specific request.

Related: State, ID Token

O

OAuth 2.0

An authorisation framework that enables applications to obtain limited access to user accounts.

Key concepts:

Delegated access (no password sharing)
Token-based
Multiple grant types
Standardized flows

In Open Banking: OAuth 2.0 is mandated by regulations.

Related: OIDC, Authorisation Code Flow

OIDC (OpenID Connect)

An identity layer built on top of OAuth 2.0. Adds authentication to authorisation.

Adds to OAuth:

ID tokens
UserInfo endpoint
Standard claims
Identity verification

Use: Verifying who the user is, not just what they can access.

Related: OAuth 2.0, ID Token

Open Banking

A secure framework allowing regulated third parties to access bank data and initiate payments with user consent.

Enabled by:

PSD2 regulation (Europe)
FCA oversight (UK)
Standardized APIs
OAuth 2.0 / OIDC

Benefits: Innovation, competition, better user experiences

Related: PSD2, TPP

P

PAR (Pushed Authorisation Request)

A method where authorisation parameters are posted directly to the authorisation server instead of being sent in the URL.

Benefits:

More secure (no sensitive data in URLs)
Shorter URLs
Reduced risk of parameter tampering

Endpoint: POST /oidc/request

Returns: A request_uri to use in the authorisation URL

Related: Authorisation URL, Request Object

Payee

The recipient of a payment.

Can be:

API Payee (created via /payees endpoint)
MH User Account (another Moneyhub user)
Inline (details in payment claim)

Contains:

Name
Sort code
Account number

Related: Payment, Payee ID

Payee ID

Unique identifier for a payee.

Format: UUID (e.g., 3305bc2c-8848-4fe0-a529-a7f7d35a5722)

Created: Via POST /payees endpoint

Use: Reference in payment claims

Related: Payee

Payment

An instruction to transfer money from one account to another.

Types:

Single Immediate Payment (SIP)
Variable Recurring Payment (VRP)
Standing Order

Lifecycle: Pending → InProcess → Completed (or Rejected)

Related: Payment ID, PISP

Payment ID

Unique identifier for a payment.

Format: UUID

Found in: ID token claim mh:payment

Use: Check payment status via GET /payments/{paymentId}

Related: Payment

Payment Initiation Service Provider (PISP)

A type of Third Party Provider authorized to initiate payments on behalf of users.

Examples: E-commerce checkout, bill payment services

Moneyhub's role: Moneyhub is a regulated PISP

Related: AISP, TPP

PKCE (Proof Key for Code Exchange)

A security extension to OAuth 2.0 that prevents authorisation code interception.

How it works:

Generate code_verifier (random string)
Create code_challenge (hash of verifier)
Send challenge in authorisation request
Send verifier when exchanging code
Server verifies they match

Use: Essential for mobile and single-page apps

Related: Code Verifier, Code Challenge

Private Key JWT

An authentication method where the client signs a JWT with their private key to prove identity.

More secure than: Client secrets (which can be compromised)

Required for: Production Open Banking clients

Process:

Create JWT with claims
Sign with private key
Send as client_assertion

Related: Client Assertion, JWKS

PSD2 (Payment Services Directive 2)

European regulation that mandates Open Banking.

Key requirements:

Banks must provide APIs
Strong customer authentication
TPPs must be regulated
Consumer protections

Effective: Since January 2018

Related: Open Banking, FCA

R

Redirect URI

The URL where users are sent after authorisation. Must be pre-registered with your API client.

Examples:

https://yourapp.com/callback
http://localhost:3000 (development)

Security: Must exactly match registered URI

Receives: Authorisation code, state, and ID token

Related: Authorisation Code, Callback

Refresh Token

A long-lived token used to obtain new access tokens without user interaction.

Lifespan: Days, weeks, or months

Use: For ongoing access scenarios

How to get: Include offline_access scope

Security: Store securely, can be revoked

Related: Access Token, Offline Access

Request Object

A JWT containing authorisation request parameters. Can be signed for additional security.

Use: When not using PAR, or when request object signing is enabled

Contains: All authorisation parameters (scope, claims, redirect_uri, etc.)

Related: PAR, Authorisation URL

Request URI

A reference to authorisation request parameters previously posted to the server.

Format: urn:ietf:params:oauth:request_uri:abc123

Created by: PAR endpoint

Use: Included in authorisation URL instead of full parameters

Related: PAR

Resource Server

The server that hosts protected resources (data). In the Moneyhub ecosystem, this is the Moneyhub Data API.

URL: https://api.moneyhub.co.uk

Accepts: Access tokens

Returns: Account data, transactions, etc.

Related: Authorisation Server, API

REST API

An architectural style for APIs using HTTP methods (GET, POST, PUT, DELETE).

Moneyhub APIs: RESTful, JSON-based

Example:

GET /accounts HTTP/1.1
Host: api.moneyhub.co.uk
Authorization: Bearer {access_token}

Related: API, Endpoint

S

Scope

Permissions requested in an authorisation flow. Broad categories of access.

Examples:

openid - Required for OIDC
accounts:read - Read accounts
transactions:read:all - Read transactions
payment - Initiate payment
offline_access - Get refresh token
id:hsbc - Connect to HSBC

Format: Space-separated list

Related: Claim, Authorisation

State

A random value used to prevent CSRF attacks.

Use:

Generate random state
Store in your session
Include in authorisation URL
Verify it matches when user returns

Security: MUST validate; reject if mismatch

Related: CSRF, Nonce

T

Third Party Provider (TPP)

A regulated company authorized to access bank data or initiate payments via Open Banking.

Types:

AISP (data access)
PISP (payment initiation)
Combined (both)

Moneyhub: A regulated TPP (both AISP and PISP)

Regulation: Must be authorized by FCA or equivalent

Related: AISP, PISP

TLS (Transport Layer Security)

Encryption protocol for secure communication over networks. Successor to SSL.

Use: All Open Banking communication uses TLS 1.2 or higher

URLs: Start with https://

Related: mTLS

Token

A credential used in OAuth 2.0 flows. Generic term for access tokens, ID tokens, and refresh tokens.

Format: Usually JWT

Use: Authentication and authorisation

Related: Access Token, ID Token, Refresh Token

Token Exchange

The process of exchanging an authorisation code for tokens.

Request to: POST /oidc/token

Requires:

Authorisation code
Client authentication (client_assertion)
Redirect URI

Returns:

Access token
ID token
(Optional) Refresh token

Related: Authorisation Code, Token Endpoint

U

User ID

Unique identifier for a Moneyhub user.

Format: UUID

Use: Attach payments/connections to specific users

Found in: ID token sub claim

Related: Sub

V

VRP (Variable Recurring Payment)

A type of payment that allows flexible recurring payments within agreed parameters.

Use cases:

Subscriptions with variable amounts
Sweeping funds between accounts
Flexible repayments

Requires: Specific consent and bank support

Related: Payment, Standing Order

W

Webhook

An HTTP callback that notifies your application when events occur.

Use in Moneyhub:

Payment status changes
Data refresh completions
Connection expirations

Configuration: Set webhook URI in Admin Portal

Format: Can be JWT or JSON

Quick Reference

Authentication:

OAuth 2.0, OIDC, Private Key JWT, Client Assertion

Tokens:

Access Token (API calls), ID Token (user info), Refresh Token (renew access)

Security:

State (CSRF prevention), Nonce (replay prevention), PKCE (code interception prevention)

Open Banking:

TPP, AISP, PISP, ASPSP, PSD2, FCA

Payment:

Payee, Payment ID, VRP, SIP

Technical:

JWT, JWKS, JWK, API, Endpoint, REST