Skip to main content
PSD2 (Payment Services Directive II) is a European Union directive that updates the legal framework for payment services. It aims to liberalize the payment industry and boost competition, enhance the security of payment service users, foster innovation in the payments sector, and clearly define the rights and obligations of payment service providers and users. Initiating a payment is a sensitive action regulated under PSD2: to be PSD2 compliant, Qonto requires Strong Customer Authentication (SCA) on sensitive actions. This guide puts together what you need to make a SEPA transfer.
For a complete, runnable walkthrough (Python and Node.js), see the use case How to send a SEPA transfer to a trusted beneficiary.
1

Get an OAuth 2.0 access token with payment.write

To execute sensitive actions using SCA, users must have granted access to your application from their account via OAuth 2.0. Creating a SEPA transfer requires the payment.write scope.payment.write is a sensitive scope: it allows initiating outbound payments to any beneficiary. If your application uses sensitive scopes, additional approval is required before going to production — except for Automate your business operations, which requires no review even for sensitive scopes. See Sensitive scopes.
2

Verify the payee

Call Verify a SEPA payee (or the bulk version) to match the IBAN with the beneficiary name. The proof_token included in the response is required for initiating a SEPA transfer and will be valid regardless of the verification result. See Verification of Payee.
3

Create the transfer

Call Create a SEPA transfer. This operation requires Strong Customer Authentication unless the beneficiary is trusted (see below).When SCA is required, you receive a 428 Precondition Required response with a sca_session_token (valid for 15 minutes), and the user is asked to approve the action with the SCA method you chose in the X-Qonto-2fa-Preference header (paired-device, passkey or sms-otp). Poll Retrieve an SCA session until it returns allow, then repeat the original request with the X-Qonto-Sca-Session-Token header (and the same X-Qonto-2fa-Preference header, if you sent one). The full flow is described in Strong Customer Authentication.

​
Trusted beneficiaries

Trusting a beneficiary is important for API integrations because it enables automated transfers without requiring Strong Customer Authentication (SCA) verification for each transaction. When a beneficiary is not trusted, your users need to verify their identity for each transfer made via partner integrations.
Trusting a beneficiary lets your integration initiate transfers to that beneficiary without requiring SCA on every transaction. The actual transfer still requires payment.write.
Note for regular Qonto customersIf you are not using the API, you can also mark a beneficiary as trusted directly from the Qonto web app by enabling the “Allow automated transfers” option on the beneficiary’s profile. This option is available on web only. Learn how to mark a payee as trustworthy →

​
Test in the Sandbox

You can test sensitive actions in the Sandbox with mocked SCA sessions: see Testing a sensitive action on the Sandbox environment.

​
Licensed partners (TPP)

If you are a licensed partner, you must identify yourself through your QSeal certificate when calling our Business API endpoints in Production (cf. the requirements); otherwise you will receive a 401 Unauthorized error to your API calls. To initiate payments, your license should be a PIS license. More answers in the PSD2 FAQ.