Requirements

Eligibility, licensing, and eIDAS certificate requirements to access Klarna's XS2A v2 (Berlin Group openFinance) PSD2 API.

2 min read

Klarna Bank AB acts as the ASPSP (Account Servicing Payment Service Provider) and exposes this API under the Berlin Group openFinance (NextGenPSD2) Framework v2.x. To call it in production you must be a licensed Third Party Provider (TPP) under PSD2 and authenticate with a valid eIDAS certificate over mutual TLS.

Who can access the API

To access the XS2A v2 API you must:

1.
Be a licensed TPP under PSD2, authorised by a national competent authority (e.g. BaFin) for at least one of the PSD2 services.
2.
Hold a valid eIDAS certificate (QWAC) issued by a Qualified Trust Service Provider (QTSP), used for mutual identification.
3.
Present that certificate on every request via mutual TLS (mTLS).

PSD2 roles

Your eIDAS certificate carries one or more PSD2 roles (encoded in the certificate's QcStatements extension, OID 1.3.6.1.5.5.7.1.3). The role determines which parts of the API you may use:

PSD2 role	Certificate role	Grants access to
Account Information Service (AIS)	`PSP_AI`	Consent & Account Information — create consents, read accounts, balances and transactions
Payment Initiation Service (PIS)	`PSP_PI`	Payment Initiation — initiate and query payments
Confirmation of Funds (PIIS)	`PSP_IC`	Funds confirmation — planned, not yet available. The role is accepted in a certificate, but no funds-confirmation endpoint exists yet.
Account Servicing (ASPSP)	`PSP_AS`	Reserved for the ASPSP (Klarna). Not a TPP role — a certificate presenting only `PSP_AS` is rejected.

A certificate may include several TPP roles at once (for example PSP_AI + PSP_PI). Each operation is authorised against the role(s) in your certificate; calling an operation outside your roles is rejected.

The required eIDAS certificate profile, accepted QTSPs, mTLS handshake, certificate validation errors, and sandbox access are all covered in Authentication.

Scope and limitations

This implementation deliberately supports a subset of the Berlin Group v2 standard. Most relevant for onboarding:

Only payment accounts are in scope (the cards, cardAccounts, savings, loans and securities product buckets are not supported).
Account-information consents support only the detailed and global consent types.

The full list is documented in Deviations from Berlin Group v2.

Environments and network access

Base URLs and per-environment access (test certificates and production eIDAS requirements) are described in URLs & Environments.

Support

For onboarding and integration questions, contact support.xs2a.banking@klarna.com.

Jump to section...