Authentication / token issues

How does the authentication part of your API work?

We use OAuth2 as our chosen authorization framework.

OAuth2 flow in the context of this documentation refers to Nordea's OAuth2 implementation, and it has a lightweight UI for granting the consent for single TPP. In more detail, we are using the Authorization Code Grant flow from the OAuth2 specification.

The flow is initiated upon request from the TPP. Nordea stores the consent given by the user as a part of this flow, and the user can change it at any given time.

How long is the access token valid? When will it expire?

The access token is valid for 90 days.

It would be nice to receive a push message when an access token is about to expire (e.g. 7 days before)

Agreed, this would be nice ;) We're looking into this already.

I don't understand how OAuth2 works

For a nice tutorial about OAuth2, please check this link.