Banno app provisioning and API authentication requirements

Banno SDK
,
1

What are you trying to build?

We are a third-party vendor integrating with a mutual customer’s Banno environment via the Consumer API and Admin API.

Per the JHA Developer Portal documentation, API access requires an External App to be registered within the FI’s Banno environment, which generates the client ID/secret used for authentication.

Since we don’t have direct access to the customer’s Banno admin console, we need clarification on the External App provisioning, authentication, scopes, and permissions required before we proceed.

Environment

Product or API:

Banno Digital Toolkit – Consumer REST API and Admin REST API

Environment:

Sandbox and Production

Platform or runtime:

Third-party vendor application / backend service

Authentication flow:

Not configured yet. We need clarification on the required OAuth/OIDC authentication flow for the External App.

Documentation consulted:

JHA Developer Portal documentation for Banno Digital Toolkit / Consumer API / Admin API

What did you try?

We have not created or provisioned an External App yet.

Before proceeding, we would like clarification on the following:

External App Provisioning

Can you confirm that the FI (our mutual customer) is solely responsible for creating the External App in their sandbox and production environments? If so, what specific role/permission level within Banno is required on their end to do this, so we can guide them accordingly?

Authentication Framework

Does the OAuth/OIDC flow for this External App require JWKS configuration (as used in other JXchange/Banno People-based products), or is a different key-exchange/authentication mechanism used for Consumer and Admin API access?

OAuth Scopes

Which scopes are required for token issuance? Is openid sufficient, or are there additional Banno-specific scopes required to access Consumer API and Admin API endpoints respectively?

Permissions Model

What permission set(s) must be assigned to the External App to support:

  • Consumer API calls executed under an Admin-issued access token (i.e., acting on behalf of end users).

  • Direct Admin API calls for account/customer data management.

Do these require separate scopes/permissions, or is there a single combined permission set on the External App registration?

What happened?

We have not encountered an error because the External App has not yet been created.

We are looking for confirmation of the required provisioning, authentication, OAuth scopes, and permission model so that we can correctly guide our mutual customer and proceed with the integration.

Expected result:

Confirmation of:

  1. Which party is responsible for creating the External App.

  2. The required Banno role/permissions for creating it.

  3. The required authentication/OAuth/OIDC flow and whether JWKS configuration is required.

  4. The required OAuth scopes for Consumer API and Admin API access.

  5. The required External App permission set(s) for Consumer API and Admin API access.

  6. Whether Consumer API and Admin API access require separate or combined configuration.

Actual result:

External App provisioning and authentication have not yet been configured because we need clarification on the requirements above.

HTTP status, if applicable:

N/A

x-request-id, if available:

N/A

UTC date and time:

N/A

Safe-posting confirmation

  • I removed tokens, secrets, private keys, passwords, SSNs, account
    numbers, customer data, and institution-confidential configuration.