Updated 2025-10-09. 

This Article is updated with: PSD2 SSA and Premium API SSA.

The SSA is a JSON Web Token (JWT) containing client metadata about an instance of Third Party Provider (TPP) client software. The JWT is created and signed by the TPP using their eIDAS certificate private key.

OAuth 2.0 Software Statement

SSA Payload for PSD2:

The certificate must be eIDAS certificate. The payload of an Nordea Open Banking SSA MUST be a compliant software statement according to [RFC7591]. The SSA MUST also be a compliant JWT according to [RFC7519].

The following metadata profiles the metadata in [RFC7591] and [RFC7519]:

The following software metadata is additionally defined for this profile:

The following Organisational metadata is defined for this profile:

SSA Header

The SSA header MUST comply with [RFC7519].

Example PSD2 SSA

{
    "typ": "JWT",
    "alg": "RS256",
    "kid": "BF1DBE546F12ABC8E83B37A0FC40C78B702A6613"
}
{
    "iss": "TPP XYZ Ltd",
    "iat": 1492756331,
    "jti": "d4a1d1ae-15b2-11ea-8d71-362b9e155667",
    "software_client_name": "TPP Awesome APP",
    "software_client_description": "Awesome app for personal finance",
    "software_version": "2.2",
    "software_redirect_uris":
    [
        "https://tpp.com/cb",
        "https://tpp.uk/cb"
    ],
    "software_roles": [
        "PISP",
        "AISP"
    ],
    "organisation_competent_authority_claims": [
      {
        "authority_id": "FMA",
        "registration_id": "111111",
        "status": "Active",
        "authorisations":  [
                {
                    "member_state": "GBR",
                        "roles": [
                            "PISP",
                            "AISP"
                    ]
                },
                {
                    "member_state": "ROI",
                        "roles": [
                            "PISP"
                    ]
                }
            ]
      }
    ],
    "org_id": "Amazing TPPID",
    "org_name": "OpenBanking TPP Registered Name",
    "org_contacts": [
      {
        "name": "contact name",
        "email": "contact@contact.com",
        "phone": "+447890130558",
        "type": "business"
      },
      {
        "name": "contact name",
        "email": "contact@contact.com",
        "phone": "+447890130558",
        "type": "technical"
      }
    ]
}
{
    Signature
}

The Base64 encoded JWT created with above header and payload:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IkJGMURCRTU0NkYxMkFCQzhFODNCMzdBMEZDNDBDNzhCNzAyQTY2MTMifQ.eyJpc3MiOiJUUFAgWFlaIEx0ZCIsImlhdCI6MTQ5Mjc1NjMzMSwianRpIjoiZDRhMWQxYWUtMTViMi0xMWVhLThkNzEtMzYyYjllMTU1NjY3Iiwic29mdHdhcmVfY2xpZW50X25hbWUiOiJUUFAgQXdlc29tZSBBUFAiLCJzb2Z0d2FyZV9jbGllbnRfZGVzY3JpcHRpb24iOiJBd2Vzb21lIGFwcCBmb3IgcGVyc29uYWwgZmluYW5jZSIsInNvZnR3YXJlX3ZlcnNpb24iOiIyLjIiLCJzb2Z0d2FyZV9yZWRpcmVjdF91cmlzIjpbImh0dHBzOi8vdHBwLmNvbS9jYiIsImh0dHBzOi8vdHBwLnVrL2NiIl0sInNvZnR3YXJlX3JvbGVzIjpbIlBJU1AiLCJBSVNQIl0sIm9yZ2FuaXNhdGlvbl9jb21wZXRlbnRfYXV0aG9yaXR5X2NsYWltcyI6W3siYXV0aG9yaXR5X2lkIjoiRk1BIiwicmVnaXN0cmF0aW9uX2lkIjoiMTExMTExIiwic3RhdHVzIjoiQWN0aXZlIiwiYXV0aG9yaXNhdGlvbnMiOlt7Im1lbWJlcl9zdGF0ZSI6IkdCUiIsInJvbGVzIjpbIlBJU1AiLCJBSVNQIl19LHsibWVtYmVyX3N0YXRlIjoiUk9JIiwicm9sZXMiOlsiUElTUCJdfV19XSwib3JnX2lkIjoiQW1hem9uIFRQUElEIiwib3JnX25hbWUiOiJPcGVuQmFua2luZyBUUFAgUmVnaXN0ZXJlZCBOYW1lIiwib3JnX2NvbnRhY3RzIjpbeyJuYW1lIjoiY29udGFjdCBuYW1lIiwiZW1haWwiOiJjb250YWN0QGNvbnRhY3QuY29tIiwicGhvbmUiOiIrNDQ3ODkwMTMwNTU4IiwidHlwZSI6ImJ1c2luZXNzIn0seyJuYW1lIjoiY29udGFjdCBuYW1lIiwiZW1haWwiOiJjb250YWN0QGNvbnRhY3QuY29tIiwicGhvbmUiOiIrNDQ3ODkwMTMwNTU4IiwidHlwZSI6InRlY2huaWNhbCJ9XX0.gwrWkv8FwToAhB0XcobplySx5mNtuv7ZSDr5PvUbUtRx22171p8veejw2ZtE4hNsIa5JGTlAJ4fi4oGTQCzWhx6uPYsYhAEvro2FbCH5jYErMB6u67kMDxvmeXpra82IKk_iN8HrrVr7ogkxiZipNvj_dAhHbp83kbq_f2dcL4v5HwCXvOYTz94zsb1syyWWElDCpLUeQTbssFw8yAKqs3m9dPo9A1MufeZzW7KTi0sXagYL0trbnXcXqYJUF1Zi7SQYryI6pAyHi7TJ0jfl7xodUGpuQEudmTo0znITBECIBlw9vc4j_ZgXhKAW4A6u8F213ZnWBSerXCUaDf3ROA

Note: Software statement token needs to contain 3 parts separated with dots: 

{header}.{payload}.{signature}

and the expected JWT signing algorithm is RS256.

SSA Payload for Premium APIs.

The SSA is a JSON Web Token (JWT) containing client metadata about an instance of Customer/vendors client software. The JWT is created and signed by the Customer/vendor using their Nordea issued certificate private key.

The certificate must be Nordea issued PKI X509 CA04 certificate. The payload of a Nordea Open Banking SSA MUST be a compliant software statement according to [RFC7591]. The SSA MUST also be a compliant JWT according to [RFC7519].

The following metadata profiles the metadata in [RFC7591] and [RFC7519]:

The following software metadata is additionally defined for this Premium API profile:

The following Organizational metadata is additionally defined for this Premium API profile

SSA Header 

The SSA header MUST comply with [RFC7519].

Example Premium SSA

{
 "software_client_name": "Premium Awesome APP",
 "product_name": "MULTI_PAYOUT_INSTANT",
 "org_contacts": [
    {
      "name": "Jane Doe",
      "email": "jane@company.com",
      "phone": "+447890130558",
      "type": "business"
    },
    {
      "name": "John Doe",
      "email": "john@company.com",
      "phone": "+447890130558",
      "type": "technical"
    }
 ],
 "iss": "Customer/vendor AB",
 "iat": 1760089723,
 "jti": "e1f51064-8876-43bd-aaa5-f5b59a12886d"
}

The Premium SSA must be Base64 encoded JWT created with header and payload.

eyJraWQiOiJCRjFEQkU1NDZGMTJBQkM4RTgzQjM3QTBGQzQwQzc4QjcwMkE2NjEzIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzb2Z0d2FyZV9jbGllbnRfbmFtZSI6IlByZW1pdW0gQXdlc29tZSBBUFAiLCJwcm9kdWN0X25hbWUiOiJNVUxUSV9QQVlPVVRfSU5TVEFOVCIsIm9yZ19jb250YWN0cyI6W3sibmFtZSI6IkphbmUgRG9lIiwiZW1haWwiOiJqYW5lQGNvbXBhbnkuY29tIiwicGhvbmUiOiIrNDQ3ODkwMTMwNTU4IiwidHlwZSI6ImJ1c2luZXNzIn0seyJuYW1lIjoiSm9obiBEb2UiLCJlbWFpbCI6ImpvaG5AY29tcGFueS5jb20iLCJwaG9uZSI6Iis0NDc4OTAxMzA1NTgiLCJ0eXBlIjoidGVjaG5pY2FsIn1dLCJpc3MiOiJDdXN0b21lci92ZW5kb3IgQUIiLCJpYXQiOjE3NjAwODk3MjMsImp0aSI6ImUxZjUxMDY0LTg4NzYtNDNiZC1hYWE1LWY1YjU5YTEyODg2ZCJ9.XAXpq2SJLTq4hcIWm4wUtVKO-vfaEv8EemPtj6P656DXg9KU6PNDuZOPm0xF-lFimByxjtXT8oZI1-VIxWpQGwILd353UHwV8lGjXr_Pa7X7Hn0oWwrErQspmVOgolOfgdJobLaF5mXDXLFiU87OIzKyvYdCCccQDTDb52R_jJYGHN3KRD8JAtPeA_oXA0Ahf2JxmM7680UE0xDDWEMmyFEDrd1OvZSp44Kg0a9Nwb705NyFzP8jMrwMR4q8CMWWzUKEujCjwLMaALcq5IxAlC5UR4AtnlqbJZC3dLvvP4J4IAL1SZhQ8h1Vcf1Wlfy8cAysKme9rpANHDDQberTYg

Note: Software statement token needs to contain 3 parts separated with dots: 

{header}.{payload}.{signature}

and the expected JWT signing algorithm is RS256.

Error texts and responses

The problems regarding the eIDAS certificate validations can be caused by several reasons. Below is a list of reasons for situations when the eIDAS certificate cannot be correctly validated.

• The certificate has been revoked = Certificate not longer valid.
• The certificate is not trusted = Certificate root path is not valid or incorrect.
• The certificate is malformed = Certificate string pasted into eIDAS textbox in the registration form is not valid or not readable.
• The certificate has expired = Certificate has expired and needs to be renewed.
• Certificate validation service is not responding = Nordea is unable to process the request. Please resend the request.

Role validation in eIDAS PSD2 certificate

QTSP providers have a connection to National Competent Authorities to verify the PSD2 license, license number and PSD2 roles before issuing the eIDAS certificate to the TPP acquiring it. The key-thing in this certificate is the unique ID (authorization number of the PSP) which originates from the TPP’s ‘Home National Competent Authority’ (NCA), the local authority that grants the PSD2 licenses to TPPs. By this number it is possible to find the TPP in question from official public registers. Within such registers, it is possible to see what PSD2 ‘roles’ the TPP is licensed to play (AISP, PISP, CBPII). Note that role information can be found in the certificate "Qualified Certificate statement".

If these options did not help, there might be other reasons why the eIDAS validation fails. Reach out to your QTSP provider for support.

FAQ

Question

While submitting the onboarding form:

Compliance (PSD2) API Products Onboarding

I get "Registration failed as the Software Statement token is invalid. Please, edit the Software Statement token and try again. For more information, see OAuth 2.0 Software Statement." error:
 

Answer

Make sure that:

• your SSA is signed with your eIDAS/Premium Certificate private key
• your SSA doesn't contain any redundant characters at the beginning and the end, e.g.: "\", \""

Note: create a new SSA without those characters since cleaning the result (characters) might brake SSA

• "roles" under "authorisations" are according to specification/our sample code above
• "software_version" is a string, e.g.: "1.0"