Enable Banking Control Panel

Overview

enable-banking-api

enable-banking-sandbox

enable-banking-ui-widgets

Workflow

1. Identify the Control Panel area involved: signup, API applications, activation, request logs, statistics, sharing, ASPSP status, Data Insights, Mock ASPSPs, or MFA.
2. Read references/control-panel-reference.md for exact steps and terms.
3. Distinguish sandbox vs production and default/shared infrastructure vs dedicated infrastructure.
4. For production issues, determine whether the app is fully activated, restricted by account linking, or pending manual review.
5. For API debugging, use request logs and preserve request details such as request ID, authorization ID, session ID, account ID/hash, ASPSP, country, timestamp, PSU type, and session status.

Core Rules

• New Control Panel accounts are created automatically on first email sign-in.
• Sandbox app registration requires application name and redirect URLs; production apps relying on Enable Banking authorization require additional end-user-facing and compliance details.
• If using browser-generated keys, the private key is downloaded locally and not transmitted to Enable Banking. The file name matches the new application ID.
• Production apps can be fully activated by manual review or restricted to linked own accounts for internal testing.
• Dedicated-infrastructure apps for authorized TPPs can be activated automatically if the registering Control Panel user has MFA enabled.
• Sharing applications can require recipients to enable MFA when the sharing user has MFA enabled.
• Use Control Panel request logs and ASPSP status before assuming an application code regression.

Project Placement

• Mirror application IDs, environment, allowed redirect URLs, and widget origins in server-side configuration docs or env setup, not frontend code.
• Keep production activation and account-linking assumptions explicit in internal runbooks or implementation notes.
• Use request log fields to correlate application records with Enable Banking authorization/session/account/payment records.
• Do not store browser-downloaded private keys in the repo. Treat them as local secrets.