TBC ID

TBC ID provides OpenID Connect APIs for authenticating users, obtaining their consent, and retrieving the user information and claims authorized by the user.

The API supports the Authorization Code Flow with PKCE and Client-Initiated Backchannel Authentication (CIBA), including token issuance and refresh.

It also provides OpenID Connect discovery metadata and public signing keys (JWKS) for validating tokens.

Use the access token issued by the selected flow to request authorized claims from the Userinfo endpoint.

Endpoints

Sandbox Base URLs:

• https://test-api.tbcbank.ge
• https://test-openbanking.tbcbank.ge

Production Base URLs:

• https://api.tbcbank.ge
• https://openbanking.tbcbank.ge

Proccess

Authorization Code Flow

1. Prepare the request. Create a fresh, unpredictable state value bound to the user's session. If an ID token is expected, also create a fresh nonce. Add a claims object to request the user claims your application needs from the UserInfo endpoint; request only claims supported by the provider. If using PKCE, generate and retain the code_verifier and corresponding code_challenge.
2. Start authorization. Redirect the user's browser to the authorization endpoint, including the registered client_id and redirect_uri, response_type=code, the requested scopes including openid, and applicable security and optional parameters.
3. Follow the consent redirect. The authorization endpoint returns 302 Found with the consent page URL in the Location header. Redirect the user's browser there so they can approve or decline the request.
4. Handle the callback. After the user makes a decision, TBC Bank redirects the browser to the registered redirect_uri with either an authorization code or an error and error_description. Validate the returned state before processing the response. If the user approved, keep the code confidential and exchange it promptly.
5. Exchange the code. Send the code to the token endpoint along with the required form parameters. If using PKCE, include the original code_verifier.
6. Use the tokens. Validate the token response and the ID token, including its signature, issuer, audience, expiration, and nonce when applicable. Check that the ID token's acr reflects the authentication class actually performed. Use the access token to call the authorized resource. To retrieve user claims, call the UserInfo endpoint.

CIBA Flow

1. Start authentication. Send the initial backchannel authorization request with client_id, the user's login_hint, and all requested scope and claims (including verified claims). Include any applicable ui_locales.

   IMPORTANT:
   Send all requested claims, including verified claims, in the initial backchannel authorization request.

2. Get the request ID. TBC Bank returns an auth_req_id and polling information. If the request is rejected, handle the error and stop the flow.
3. SMS is sent. Immediately after the initial backchannel authorization request, TBC Bank sends an SMS OTP to the user.
4. Poll for the first token response. After the SMS is sent, poll the token endpoint using the CIBA grant_type and the initial auth_req_id. Continue at the instructed interval while the request is pending. When this authentication phase completes, TBC Bank returns an id_token and an access_token. This first response must not contain a refresh_token. Check whether the ID token is intermediate or final, as described in section 10.2.3 of the applicable specification:
   • Final ID token: authentication is complete. Do not send a second backchannel request; use the access token as authorized for the resource.
   • Intermediate ID token: retain the intermediate ID token and access token, then continue to the next step.

     IMPORTANT:
     The intermediate token response is not the final resource authorization when its ID token is identified as intermediate.

5. Submit the SMS code. After the user enters the OTP in your application, send a second backchannel authorization request with client_id, the intermediate ID token as id_token_hint, and the OTP as user_code.
6. Poll for final tokens. Use the second request's auth_req_id to poll the token endpoint. On success, TBC Bank returns a new id_token and access_token; a refresh_token may also be returned.
7. Use the access token. Once authentication is complete, validate the token response and use its access token to call the authorized resource. This is the first response's access token when its ID token is final, or the second response's access token when the first ID token is intermediate. To retrieve user claims, call the UserInfo endpoint.