Upcoming changes in Swedish payment infrastructure

Sweden is facing one of the biggest changes in the history of its payment infrastructure, regarding the updated payment type Credit Transfer. Please refer to the information in the below link.

PLEASE NOTE - INFORMATION ABOUT V 2 PAYMENTS APIs!

Update regarding V2 Payments API for Swedish customers.

The withdrawn V2 Private Payments API will be relaunched after summer. Exact date will be communicated closer to the launch and we are then welcoming you to switch from the V1 Payment API.

The V2 version, both corporate and private, will have added endpoints for Other Bank Domestic Credit Transfer (all other endpoints in V2 remain the same) and must only be used for payments that should be processed a.s.a.p. as we recognize this is important for some TPPs.

In short:

- When the Other Bank Domestic Credit Transfer is used the account is debited straight after the payment has past all internal validations.

- When the SEK Credit Transfer payment is used the account is debited by choice of the TPP/Customer (future dated).

Updates will be communicated via email and the Developer Portal. The V1 Payment API remains fully supported and available. We apologize for any inconvenience caused.

Information regarding SEK Credit transfer

For frequently asked questions and answers about SEK Credit transfer please follow below link

FAQ: FAQ about SEK Credit Transfer

Technical FAQs

How long are the access / refresh tokens and consents valid for?

Intent (validity) - how long the PSU has to confirm the intent after a POST/ Consent or POST/ Payment is made by a TPP.
Access token (validity) - how long the ACG / DG token, which is needed to call the APIs, is valid for.
Refresh token (validity) - how long the refresh token, which is required to get a new access token, is valid for.
Consent (validity) - how long the consent given to the TPP from the PSU, is valid for.

Intent typeIntent (validity)Access token (validity)Refresh token (validity)Consent (validity)
Accounts15 mins24 hours90 days90 days for GB, 180 days for the other supported countries
Card Accounts15 mins24 hours90 days90 days for GB, 180 days for the other supported countries
Payments15 mins15 minsN/A15 mins
Confirmation of Funds15 mins15 minsN/AUntil consent is removed

Important: The above times are what the value times are currently set at. However, please always use the expires_in parameter value rather than hard-coding the set time values (e.g. 24 hours, 15 mins), as these could change in the future.

How do I integrate with your authorization flow?

Please refer to our Technical Guidelines, specifically the ones dedicated to SCA Decoupled and SCA Redirect

 

 

How can I update the Redirect URL for my App?

At the moment, we don't support functionality for updating Apps (other than adding subscriptions). So to update the Redirect URL for your App, you'll need to register a new App with the new Redirect URL. The functionality to update the Redirect URL for an existing App is in our road map for future improvements.

How does the SCA Decoupled authentication flow work in case we don't support QR codes?

The BankID app always needs to be started with an autoStartToken. The autoStartToken is used in two ways:

1) If the Mobile BankID app is on a different device, you have to build a QR code based on the autoStartToken.
2) If the Mobile BankID is on the same device, you can use the autoStartToken as a query-parameter.