Integrator access
The FI chooses which Moov Money operations your integrator can call. You cannot grant yourself access to an FI.
Set up an affiliation #
Moov sets up your integrator account. Each FI opts in separately through Moov Money onboarding and uses its existing Moov account. The FI must already have a connection to your integrator account. Moov Money does not create or remove that connection.
The FI grants Moov Money scopes on that connection. The grants apply to the FI’s account, not to every FI you serve. The FI can change them without removing the other access on its connection to you.
What each state allows #
| Affiliation state | What you can do |
|---|---|
pending | Use setup routes for which the FI granted scopes: read or update receiver configuration, manage signing secrets, and verify receiver endpoints. Operational routes are not admitted. |
active | Use routes for which the FI granted the required scopes. The FI and your integrator account must both be active. |
offboarding or offboarded | Delegated routes are not admitted. |
Setup routes still require their scopes. An active affiliation does not grant scopes the FI did not give you. The FI’s own credentials work independently of its affiliation with you.
Scopes for setup and participant tokens #
The FI grants moov-money-config.read to read receiver configuration
and signing-secret details. It grants moov-money-config.write to change
receiver configuration and signing secrets, and to verify receiver
endpoints. Credential references use the account that owns the routing
values; see receiving calls from Moov Money.
Minting a participant token requires the FI’s
moov-money-tokens.write scope and an active affiliation. Application
tokens must also include the account-scoped route scope, such as
/accounts/{providerID}/moov-money-tokens.write. See
calling Moov Money for an FI.
For the two connections and the setup steps, see integrating for an FI.