Skip to main content
Yapily multiple consents represent the cases where the Institution returns more than one authorisation code, for example with AMEX, if the user authorises their consent to share two or more accounts, AMEX will return a consent for each card.
We do not recommend executing account authorisation requests for AMEX without either using a callback or a custom redirect. If done so, if the user authorises more than one AMEX account, you will only be able to track the first account authorised by the bank using the consent id (returned in authorisation request response). Any extra consents will be created but you will not be able to receive the consent id for the additional consents without using the callback or redirect.

​
Use with a callback

If you have created an authorisation request with a callback and the bank returns multiple consents, you will receive the consents as query parameters at the callback in the format: ?consent=\{value1\}&consent=\{value2\}... e.g.
docs_amex_multiple_consents_callback_example

​
Use with a redirect url

This section only applies if you have your own Open Banking AISP/PISP licenses and are using your own certificates to register with each Yapily Institution. See Redirect Url for more information.
For AMEX, the response at the redirect will contain multiple comma separated authToken values and one state: ?authToken=\{value1\},\{value2\}...&state=\{value\} e.g.
You will then need to execute (Forwarding) Send OAuth2 Code for each authToken with the same state to retrieve a consentToken for each of the user’s accounts that have been authorised for sharing.

​
Use with one-time-token

Similarly, when you also specify to use a one-time-token in the authorisation request and the bank returns multiple consents, you will get one-time tokens as query parameters at the callback in the format: ?one-time-token=\{value1\}&one-time-token=\{value2\}... e.g.
docs_amex_multiple_consents_callback_ott_example You will then need to execute Exchange One Time Token for each one-time-token to retrieve a consentToken for each of the user’s accounts that have been authorised for sharing.