Open Banking
What open banking means in the Spare platform and how consent drives access.
Open banking lets regulated third parties initiate payments and access account data with a payer's explicit consent. Spare is the API layer between your application and licensed financial institutions, so you don't build bank-by-bank integrations.
In this guide
- What open banking means for payment initiation
- The roles of your app, Spare, and the payer's bank
- Core platform objects you will work with
- How tenant and provider selection works
What is open banking?
In traditional integrations, each bank exposes different APIs, auth flows, and certificate requirements. Open banking standardizes how a payer authorizes a third party (you) to act on their behalf at their bank.
For payment initiation, the payer:
- Sees what they are approving (amount, beneficiary, schedule if applicable)
- Authenticates at their bank
- Grants consent for that specific payment or mandate
Spare runs this flow and gives you one API regardless of which bank the payer selects.
Platform architecture
Your application
Your backend holds API credentials (appId, apiKey) and calls Spare server-to-server. Your frontend (or Spare Link) collects payer authorization, never your API key.
Spare API
Handles provider routing, consent records, payment execution, mandate scheduling, and status APIs. You interact through REST endpoints today; official SDKs are coming soon (under review).
The payer's bank
The licensed financial institution (LFI) where the payer holds their account. Authorization always happens at the bank; Spare does not store payer passwords.
Core objects
Understanding these objects upfront makes every other guide easier to follow.
| Object | What it represents | Created when |
|---|---|---|
| Provider | A bank or institution available in your tenant | Listed via API, you do not create providers |
| Payment request | Your intent to collect money (amount, beneficiary, type) | POST /payment-requests |
| Payment consent | Payer authorization linked to a request | Created from a payment request or via Spare Link |
| Payment | A settled or in-flight bank payment | After consent is authorized and execution runs |
| Mandate | Permission for recurring or scheduled payments | Created as part of multi-payment / schedule flows |
| Bank account | Your creditor account that receives funds | POST /payment/bank-account |
Payment initiation vs account information
Spare's public API focuses on payment initiation (PIS), moving money with consent. Account information services (balances, transactions) may be available depending on your product configuration and region. These docs cover PIS flows.
Regional tenants
Pass the tenant header (or SDK tenant field) for your operating region, for example UAE. The tenant determines:
- Available providers and payment types
- Currency and validation rules (e.g. AED in UAE)
- Regulatory context applied transparently through the API
You do not need separate API hosts per country beyond sandbox vs production.
Authorization models
Two patterns are supported for collecting payer approval:
| Pattern | Best for | Docs |
|---|---|---|
| Direct API consent | Full control over redirects and branding | Payment flow |
| Spare Link | Faster integration with hosted bank UI | Spare Link |
Both produce the same underlying consent and payment objects.
What Spare handles for you
| Concern | Spare provides |
|---|---|
| Bank connectivity | Provider directory and routing to LFIs |
| Consent storage | Durable consent records with status and expiry |
| Execution | Payment submission after authorization |
| Security | Token-based API auth, signed payloads where required |
| Observability | Status APIs and webhooks |
Onboarding checklist
Before your first sandbox payment:
- Obtain sandbox
appId,apiKey, andtenant - Read Payment flow and Consent lifecycle
- Register a creditor bank account
- Complete the Quickstart
Key takeaways
- Open banking means payer-authorized access, consent is the legal and technical gate for every payment.
- You work with payment requests, consents, and payments, not raw bank APIs.
- Choose direct API or Spare Link for authorization; the domain model is the same.