Migration from the legacy XS2A API
Key differences between Klarna's legacy XS2A API and the new XS2A v2 (Berlin Group openFinance) PSD2 API, and what happens to existing consents.
4 min read
The XS2A v2 API is a new, independently hosted implementation of the Berlin Group openFinance (NextGenPSD2) Framework. It is not a drop-in replacement — endpoints, base URLs, and certain behaviors differ from the legacy XS2A API. Review the differences below before you plan your migration.
What is different
| Area | Legacy XS2A API | XS2A v2 API |
|---|---|---|
| Base URL | https:/ (Production), https:/ (Sandbox) | New, dedicated hostnames — see URLs and environments (to be confirmed before GA). Legacy and v2 are not reachable at the same base URL. |
| Standard reference | Berlin Group-based, documented informally with no published deviations list | Formal Berlin Group openFinance 2.x implementation (AIS interface v2.1, PIS interface v2.3) with a published Deviations from Berlin Group v2 reference |
| Certificate / role model | eIDAS certificate over mTLS; certificate roles referred to as AIS, PIS, PIIS | eIDAS certificate over mTLS using the 1-QWAC model; roles read from the certificate's QcStatements as the formal PSD2 codes PSP_, PSP_, PSP_ (see Requirements) |
| QWAC validity enforcement | Not documented | Planned: certificates exceeding the CA/Browser Forum maximum-validity schedule for their issuance date will be rejected; not enforced yet (see Authentication) |
| Certificate validation errors | Not published as a structured reference | Structured error codes (CERTIFICATE_, CERTIFICATE_, ROLE_, etc.) — see Certificate validation and errors |
| Account scope | Not published as a formal restriction | Explicitly restricted to payments accounts — cards, cardAccounts, savings, loans and securities are rejected |
| Consent types | Not published as a formal restriction | Explicitly restricted to detailed and global — accountList and aspspManaged are rejected |
| Payment scope | Not published as a formal restriction | Single payments only, JSON only, and only three products (sepa-credit-transfers, instant-sepa-credit-transfers, se-domestic-credit-transfers). No bulk or periodic payments, no pain. XML, no payment cancellation |
| Sandbox test data | Test certificate only (see legacy URLs) | Test certificate and a published set of Sandbox test PSUs with fixed IBANs, plus an SCA simulation mechanism via email tags |
Because the two APIs are separate deployments with different base URLs, integrating with v2 requires a new integration, not a configuration change against your existing legacy integration. Endpoint paths under
/v2 look similar at a glance, but treat every request, response and error shape as new — validate against the AIS and PIS references and the deviations list rather than assuming legacy behavior carries over.What happens to existing consents
This is not yet decided. Klarna has not finalized whether consents created against the legacy XS2A API will be migrated to the v2 API.
The current expectation, subject to change, is:
- Consents will most likely not be migrated automatically. A consent authorized on the legacy API is expected to remain a legacy-API-only consent.
- If migration is offered at all, it will most likely be available only on request from the TPP, and carried out as a one-off migration rather than an ongoing or automatic sync between the two APIs.
Until this is confirmed, plan for your customers to re-consent on the v2 API as part of your migration, and do not build automation that assumes legacy consents will appear in v2. This page will be updated, and the change announced in the change log, once a decision is made.
When to migrate
The legacy XS2A API keeps running alongside v2 during the transition period — see the rollout roadmap. New integrations should target v2 directly. If you already integrate against the legacy API, start planning your migration once the transition begins; the legacy API will eventually be decommissioned with advance notice as described in Regulated timelines.
For migration questions, contact
support..Jump to section...