Audience:
Consent
Some operations at Swan are considered sensitive, and sensitive operations always require user consent.
Consent is built into Swan's offer, meaning you don't handle it yourself. In fact, you can't: it's part of Swan's regulatory responsibility to manage consent. Additionally, consent can't be deactivated.
To initiate sensitive operations using the API, you need to authenticate with an access token. You can use either a user access token in the name of the user wanting to make the payment, or a project access token impersonating that user. Users must consent to granting a user access token.
Review the full list of sensitive operations in the reference section.
Consent requests move through a defined set of consent statuses.
Strong Customer Authentication (SCA)
To protect the user and comply with legal requirements, users can only provide consent through Strong Customer Authentication (SCA), a multi-factor authentication requirement for payment service providers; the SCA page also covers the consent user experience and sequence diagrams.
Multi-consents
Multi-consent allows you to group multiple consents for sensitive operations into a single consent, so your user can consent to multiple operations at the same time. For example, your user could consent to adding a card, adding an account membership, and initiating a credit transfer, all at once. Creating a multi-consent is an asynchronous operation, and you can group up to 100 child consents into one multi-consent.
When the user consents to the multi-consent, they're informed their multi-consent is complete. But child consents aren't processed immediately: execution is asynchronous, and each child consent can still succeed or fail. Refer to consent statuses for how a multi-consent and its child consents resolve.
Since execution is asynchronous, consider subscribing to consent webhooks to stay updated on the progress of each child consent.
Learn more in the guide to create a multi-consent.
Notification preferences
You can specify how your user would like to receive consent notifications, referred to as their preferred channel. Swan offers two possibilities:
- Swan sends a text message to the user, which includes the SCA link the user needs to open on their mobile device.
- You receive a notification, then you send the SCA link to your user. This is only possible if you have your own mobile app.
Consent notifications are relevant when you have both desktop and mobile apps, or when you want to optimize 3-D Secure (3DS) on mobile. They're only available for Consent flows (sensitive operations); they can't be used for OAuth flows such as login or authentication.
By default, when a user performs a sensitive operation on desktop and needs to consent, Swan sends a text message to their smartphone with the consent link. With consent notifications configured, your mobile app receives a notification instead, so the user can consent inside your mobile app. Think of consent notifications as another way to give consent alongside text messages and QR codes: as with desktop purchases that require approval from a banking app, the user initiates an action on desktop and approves it on their mobile app.
If you choose to receive the notification and send it to your user, you'll need to configure your notifications. Learn how to specify preferences and set up your own notifications in the guide to configure consent notifications.
If you use Swan's Web Banking interface, Swan sends a text message to your users for one-time passwords, logins, and consents, regardless of preferred channel and notification configuration.