# Support source: https://developer.mastercard.com/ob-accept-payments/documentation/support/index.md ## Get Help {#get-help} If you have any questions or require assistance, email the support team at [openbankingeu_support@mastercard.com](mailto:openbankingeu_support@mastercard.com). ## FAQ {#faq} ### General {#general} The Mastercard Open Finance API solution enables you to integrate bank functionality directly into your application. Our product allows you to initiate payments from your customers' bank accounts or to link their accounts to your application to enable future payments. Yes, we are currently integrating banks' new PSD2 APIs across Europe. However, to make sure you get the best experience possible, we still use our reverse engineered APIs if the quality of banks' PSD2 APIs does not meet standards. Consent is an integral part of PSD2 and collaboration with 3rd parties. The only way Third Party Providers can act on the customers' behalf is if the customer has given explicit consent (authorization) to have such permissions. The process by which a PSU gives a TPP permission to approach their ASPSP so the TPP can be granted access to the PSU's account to provide the service to the PSU is called Consent. You are initially onboarded in the Sandbox environment. Test banks are provided in this environment, which provides the same features as live banks without exposing live FI data. Production is a paid tier that allows partners to access the Mastercard Open Finance Pay API services with Supported Providers, available after onboarding. You can [contact us](https://www.mastercard.com/europe/en/business/open-finance/demo-request.html) to speak to our sales team who can walk you through the process of getting onboarded so that you can start integrating with the Mastercard Open Finance Pay APIs. The decision on when to release goods to customers is a business decision to be taken by the Merchant/Payee. However, Mastercard Open Finance Pay recommends that you wait until you can see that funds have settled into your payee/destination account before releasing any goods to your customers. This reduces the risk of shipping goods for a payment that does not settle successfully. For more information, refer to our [Payment Status Model](https://developer.mastercard.com/ob-accept-payments/documentation/payments/payment-status-model/index.md). ### Licenses and Certificate {#licenses-and-certificate} No. Although with the Mastercard Open Finance Pay API you can leverage your own Payment Initiation Service Provider (PISP) license, this is not necessary. [Contact us](https://www.mastercard.com/europe/en/business/open-finance/demo-request.html) to understand how you can benefit from our solution without a license. ### Markets and Coverage {#markets-and-coverage} For a full overview of that banks we support for Mastercard Open Finance Pay, refer to [Supported Payment Rails](https://developer.mastercard.com/ob-accept-payments/documentation/production/supported-payments-rails/index.md) for further details. We support a vast majority of the banks across Europe. And we continue to add more banks in both the B2B and B2C markets. For a full overview of that banks we support for Mastercard Open Finance Pay, refer to [Supported Payment Rails](https://developer.mastercard.com/ob-accept-payments/documentation/production/supported-payments-rails/index.md) for further details. ### Compliance and Security {#compliance-and-security} Yes. Compliance and security is integral to Mastercard Open Finance, including EU legislation, PSD2 (Revised Payment Service Directive). To make payments safer than ever, Strong Customer Authentication (SCA) is an EU requirement that is set in place to reduce fraud. This means, when a customer authorizes AIS or PIS access to their account, the bank will require the customer to authenticate using at least two of the three following authentication measures: * Something that the customer knows (password or PIN) * Something that the customer has (phone or laptop) * Something the customer is (fingerprint or face recognition) ### Using Webhooks and Receiving Notifications {#using-webhooks-and-receiving-notifications} Yes. We provide you with the ability to receive notifications for payment events. Refer to [Webhooks](https://developer.mastercard.com/ob-accept-payments/documentation/event-notifications/index.md) for details. ### Technical Troubleshooting {#technical-troubleshooting} Check these common causes: * **Certificate or signing key:** Confirm that Mastercard has registered your public certificate. Sign the JWT with the corresponding private key. * **JWT header:** Set `alg` to `RS256`. Set `kid` to the SHA-256 thumbprint of the registered public certificate, encoded using base64url without padding. * **Client claims:** Set both `sub` and `iss` to your client ID. Set `aud` to `auth.mastercard.com`. * **Time and identifier claims:** Set `exp` to a future Unix timestamp. Set `jti` to a unique GUID. * **Reused JWT:** Generate and sign a new JWT for every access-token request. * **Scope:** Request a scope that was enabled for you during onboarding and is appropriate for the endpoints you want to use. Refer to [API Basics](https://developer.mastercard.com/ob-accept-payments/documentation/api-basics/index.md) for the complete JWT and access-token process. The API returns `401 Unauthorized` when it cannot validate your access token. Check these common causes: * The `Authorization` header is missing or does not use this format: ```http Authorization: Bearer ``` * The access token has expired. Check `expires_in` when you request the token and request a new token when required. * The access token and API URL are for different environments. Use Sandbox tokens with Sandbox endpoints and Production tokens with Production endpoints. The API returns `403 Forbidden` when it validates your token but you do not have access to the requested operation. Confirm that your token contains the scope required for the endpoint and that the capability was enabled during onboarding. Refer to [API Basics](https://developer.mastercard.com/ob-accept-payments/documentation/api-basics/index.md) for access-token guidance. Refer to [Codes and Formats](https://developer.mastercard.com/ob-accept-payments/documentation/code-and-formats/index.md) for error descriptions and resolution guidance.