---
title: "Authorize"
method: POST
path: "/v3/{customerId}/BankingServices/Authorize"
tags: ["Authorization"]
---

# Authorize

`POST /v3/{customerId}/BankingServices/Authorize`

## Path parameters

- `customerId` string, required

## Headers

- `flinks-auth-key` string, required
- `Content-Type` string
- `Accept` string

## Request body

- AuthorizeRequest
  - `LoginId` string — Identifier returned by Flinks Connect after a successful customer authentication. Use this in combination with `MostRecentCached: true` to open a session against the cached data aggregated by the widget. This is the recommended flow for most integrations.
  - `MostRecentCached` boolean — Controls how the session is opened. `true` = cached mode (recommended): pair with `LoginId` to retrieve the most recently aggregated data for a customer. `false` = live mode: initiates a fresh live connection to the financial institution; typically used for manual refresh or direct API (legacy) integrations with `Username`/`Password`.
  - `Username` string — Username used to connect to the financial institution. Only used for direct API (legacy) integrations when `MostRecentCached` is `false`. Flinks Connect handles authentication for the widget integration path.
  - `Password` string — Password used to connect to the financial institution. Only used for direct API (legacy) integrations when `MostRecentCached` is `false`.
  - `Institution` string — Unique identifier of the financial institution. Only required for direct API (legacy) integrations. The widget sets this automatically.
  - `Language` string — Preferred language for the connection process (en | fr)
  - `Save` boolean — If set to true, all collected data and credentials will be saved after the request is completed.
  - `Tag` string — Custom string to attach to a specific request.
  - `RequestId` string, uuid — Required for MFA. Pass the RequestId received in the 203 response.
  - `SecurityResponses` object — Pass this parameter if you received a 203 response from the /Authorize endpoint and are calling it a second time to complete MFA questions. This parameter contains the user's responses to the MFA questions, where keys are the prompts and values are arrays of answers.

## Response `200`

Authorization successful - Session opened and RequestId can be used for subsequent data calls

- AuthorizeResponse200
  - `HttpStatusCode` integer — HTTP status code
  - `Links` Link[] — List of available data endpoints
    - `rel` string — Relationship type of the link
    - `href` string — Endpoint path
    - `example` string, nullable
  - `InstitutionName` string — Name of the financial institution
  - `Login` Login — End user's technical login information
    - `Id` string, uuid
    - `Username` string
    - `IsScheduledRefresh` boolean
    - `LastRefresh` string, date-time
    - `Type` string, nullable
  - `InstitutionId` integer — Unique identifier of the financial institution
  - `Institution` string — Name of the financial institution
  - `RequestId` string, uuid — Unique request identifier used for subsequent data calls

## Other responses

- `203` — Multi-Factor Authentication (MFA) required - Collect user's answers and call /Authorize again
- `400` — Bad Request - Invalid parameters
- `401` — Unauthorized - Authentication failed

---

[API](https://skmtc.net/flinks/apis/flinks-api.md) · [All operations](https://skmtc.net/flinks/apis/flinks-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/flinks/flinks-api/versions/0983646f91b4/schema)