Typical Auth Flows

Jack Henry’s Authentication Framework primarily utilizes standard OAuth 2.0 and OpenID Connect (OIDC) protocols to securely authenticate users and authorize access within the digital banking ecosystem. Two main flows are commonly used: the Authorization Code Flow and the Client Credentials Flow.

The Authorization Code Flow is used for authenticating end-users, such as retail banking customers or bank employees. In this flow, users log in through a secure login page provided by Jack Henry, often enhanced with two-factor authentication (2FA), if configured for the user. Upon successful authentication and user consent, the system issues an authorization code, which is then exchanged by the client application (e.g., mobile banking app, fintech service, or admin console) for an access token and an identity token. This enables the application to securely access APIs and verify user identities without handling user credentials directly. The Authorization Code Flow leverages modern security best practices, such as Proof Key for Code Exchange (PKCE), to protect against interception attacks.

The Logout Flow is used to end the session created by the Authorization Code Flow on both the client application and the authorization server. This flow allows end users to securely logout of both systems.

The Client Credentials Flow is typically used for backend or administrative scenarios, where no end-user interaction is involved. This flow allows server-to-server authentication, enabling trusted applications or services to securely obtain access tokens to interact with Jack Henry’s APIs directly. Tokens issued through this flow include specific permissions and scopes limited to administrative or internal functions, such as system integration tasks or automated back-office operations.

Both the Authorization Code and Client Credentials flows ensure secure, scoped access—Authorization Code Flow for interactive end-user scenarios, and Client Credentials Flow for automated, backend processes—forming the foundational security backbone for Jack Henry’s APIs.

Topics in this section

• Authorization Code Flow
• Client Credentials Flow
• Logout