openData Studio中文
Discover Mobile icon

Discover card account, login and deposit APIs

Discover Financial Services · Banking

Open on Google Play

Discover Mobile is the official Android app from Riverwoods, Illinois-based Discover Financial Services for U.S. cardmembers and Discover Bank customers. After password, passcode or fingerprint/face sign-in, the home portal shows Discover it credit cards (Cashback Bonus and Miles), Cashback Debit, checking and savings, CDs and money-market accounts, personal loans, and — where the household holds them — home-equity and IRA products. Cardholders activate a new it card, add it to Google Pay or Samsung Pay, start a balance transfer, file a dispute, set a travel notice, redeem rewards for cash or partner gift cards, and open a FICO Score graph. Bank customers locate surcharge-free ATMs, pay bills and e-bills, set up direct deposit, deposit cash at Walmart, manage overdraft protection and joint owners, and open a new deposit account from the same shell. Identity-theft protection, paperless statements and two-step authentication live in settings. The app is U.S.-only and sits against Capital One, Chase, American Express and Citi's official apps for everyday card and deposit servicing.

Card-account snapshots keyed by accountId and deviceAccountLastFour sit beside productType and cardType, so an it Cashback card, a Miles card and a Cashback Debit product stay distinct without the full PAN. Sign-in and FIDO responses attach sessionToken, userId and authenticator aaid values (plus deviceCorrelationId) that bind the portal session to a device. Deposit-opening requests carry customerId with the chosen product. Household-finance apps, issuer-file reconcilers and fraud desks use those keys to match statements, watch authenticator enrolment and track new checking or savings applications; openData Studio turns the same fields into callable open data.

Screenshots

  • Discover Mobile screenshot 1
  • Discover Mobile screenshot 2
  • Discover Mobile screenshot 3
  • Discover Mobile screenshot 4
  • Discover Mobile screenshot 5
  • Discover Mobile screenshot 6
  • Discover Mobile screenshot 7
  • Discover Mobile screenshot 8

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

  • Universal login

    POST /v1/portal/sessions osint

    Signs a cardmember or bank customer into the shared portal and returns the sessionToken used on later account and FIDO calls.

    Auth: Unauthenticated; a bot-protection sensor header is attached to this sign-in call. The response sessionToken is sent on later card and bank calls.

    • userName
    • userId
    • sessionToken
    • refreshToken
    • customerId
    POST /v1/portal/sessions HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userName": "jsmith",
  "userId": "U-1849203"
}
    {
  "sessionToken": "st_9f21c4a8",
  "refreshToken": "rt_b71e02",
  "userId": "U-1849203",
  "userName": "jsmith",
  "customerId": "C-440192"
}

  • Universal FIDO login

    POST /v1/portal/sessions/passkey osint

    Completes passwordless portal sign-in with a registered FIDO authenticator and returns a sessionToken bound to deviceCorrelationId.

    Auth: FIDO assertion from a registered authenticator (native fingerprint or device passcode); bot-protection sensor header on the call.

    • aaid
    • userId
    • deviceCorrelationId
    • sessionToken
    • isBiometricsCapable
    POST /v1/portal/sessions/passkey HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "aaid": "<authenticator-aaid>",
  "userId": "U-1849203",
  "deviceCorrelationId": "dc-88a1"
}
    {
  "sessionToken": "st_9f21c4a8",
  "userId": "U-1849203",
  "aaid": "<authenticator-aaid>",
  "deviceCorrelationId": "dc-88a1",
  "isBiometricsCapable": true
}

  • Portal FIDO authenticate

    POST /v1/portal/stepup/passkey osint

    Steps up an already-open portal session with a registered FIDO key and returns the key id, valid flag and created timestamp.

    Auth: Existing portal sessionToken plus a FIDO assertion from a registered authenticator. Used for step-up inside the logged-in portal, not the first sign-in.

    • aaid
    • account
    • id
    • valid
    • created
    • deviceCorrelationId
    POST /v1/portal/stepup/passkey HTTP/1.1
Authorization: Bearer st_9f21c4a8
Content-Type: application/json

{
  "aaid": "<authenticator-aaid>",
  "userId": "U-1849203",
  "account": "jsmith"
}
    {
  "aaid": "<authenticator-aaid>",
  "account": "jsmith",
  "id": "key-4410",
  "valid": true,
  "created": "2025-03-12T18:04:11:000Z",
  "deviceCorrelationId": "dc-88a1"
}

  • Bank sign-on

    POST /v1/banking/sessions osint

    Authenticates a Discover Bank customer on the bank side and issues the sessionToken used by deposit-opening.

    Auth: Unauthenticated bank-side sign-on; bot-protection sensor header on the call. Returns sessionToken for subsequent deposit calls.

    • userName
    • userId
    • sessionToken
    • refreshToken
    • customerId
    POST /v1/banking/sessions HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userName": "jsmith",
  "userId": "U-1849203"
}
    {
  "sessionToken": "st_bank_22c1",
  "refreshToken": "rt_bank_09",
  "userId": "U-1849203",
  "customerId": "C-440192",
  "userName": "jsmith"
}

  • Card account snapshot

    GET /v1/cards/account-summary openbanking

    Loads the logged-in cardmember's account record used to paint the portal card tile — product and card type plus last-four, without the full PAN.

    Auth: sessionToken from the portal sign-in (Authorization: Bearer). A bot-protection sensor header is attached to the call.

    • accountId
    • customerId
    • productType
    • cardType
    • deviceAccountLastFour
    GET /v1/cards/account-summary?accountId=A-10028471 HTTP/1.1
Authorization: Bearer st_9f21c4a8
X-Sensor-Data: <sensor-data>
Accept: application/json
    {
  "accountId": "A-10028471",
  "customerId": "C-440192",
  "productType": "IT_CASHBACK",
  "cardType": "CREDIT",
  "deviceAccountLastFour": "1234"
}

  • User ID authentication

    POST /v1/enrollment/identity-check osint

    Verifies a Discover userId during card online-banking registration before the password step.

    Auth: Unauthenticated card-enrolment step; bot-protection sensor header on the call.

    • userId
    • userName
    • customerId
    • sessionToken
    POST /v1/enrollment/identity-check HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userId": "U-1849203",
  "userName": "jsmith"
}
    {
  "userId": "U-1849203",
  "userName": "jsmith",
  "customerId": "C-440192",
  "sessionToken": "st_id_71"
}

  • Password authentication

    POST /v1/enrollment/credential-check osint

    Confirms the cardmember password during registration or sign-in and returns sessionToken plus refreshToken.

    Auth: Follows the user-ID check; bot-protection sensor header on the call. Issues the card sessionToken.

    • userName
    • userId
    • sessionToken
    • refreshToken
    POST /v1/enrollment/credential-check HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userName": "jsmith",
  "userId": "U-1849203"
}
    {
  "sessionToken": "st_9f21c4a8",
  "refreshToken": "rt_b71e02",
  "userId": "U-1849203",
  "userName": "jsmith"
}

  • Register online-banking user

    POST /v1/enrollment/users osint

    Creates the online-banking user for a card identified by accountId and deviceAccountLastFour and returns a sessionToken.

    Auth: Bot-protection sensor header on the call. Completes first-time online-banking enrolment for a card.

    • userName
    • userId
    • customerId
    • accountId
    • deviceAccountLastFour
    • sessionToken
    POST /v1/enrollment/users HTTP/1.1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userName": "jsmith",
  "userId": "U-1849203",
  "customerId": "C-440192",
  "accountId": "A-10028471",
  "deviceAccountLastFour": "1234"
}
    {
  "userId": "U-1849203",
  "userName": "jsmith",
  "customerId": "C-440192",
  "accountId": "A-10028471",
  "sessionToken": "st_reg_44"
}

  • Open deposit application

    POST /v1/deposit-applications openbanking

    Starts a Discover Bank checking, savings or CD application from the in-app opening flow and returns the new accountId.

    Auth: sessionToken from the bank sign-on call (Authorization: Bearer). A bot-protection sensor header is attached to the call.

    • customerId
    • userId
    • productType
    • accountId
    POST /v1/deposit-applications HTTP/1.1
Authorization: Bearer st_bank_22c1
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "customerId": "C-440192",
  "userId": "U-1849203",
  "productType": "SAVINGS"
}
    {
  "accountId": "D-882104",
  "customerId": "C-440192",
  "productType": "SAVINGS",
  "userId": "U-1849203"
}

  • User verification

    POST /v1/portal/verifications osint

    Re-verifies the signed-in user before a sensitive portal action and returns a valid flag on the same sessionToken.

    Auth: sessionToken from the portal sign-in; bot-protection sensor header on the call. Used when the portal needs a second factor before a sensitive action.

    • userId
    • customerId
    • userName
    • sessionToken
    • valid
    POST /v1/portal/verifications HTTP/1.1
Authorization: Bearer st_9f21c4a8
Content-Type: application/json
X-Sensor-Data: <sensor-data>

{
  "userId": "U-1849203",
  "customerId": "C-440192",
  "userName": "jsmith"
}
    {
  "userId": "U-1849203",
  "customerId": "C-440192",
  "sessionToken": "st_9f21c4a8",
  "valid": true
}

Data categories

  • card accounts
  • authentication sessions
  • FIDO authenticators
  • deposit applications
  • customer identity

Where teams use this data

  • Issuer-file card matching

    A household-finance or issuer-ops bot keys posted files on accountId, deviceAccountLastFour, productType and cardType so an it Cashback card, a Miles card and Cashback Debit stay distinct without storing the PAN.

  • Portal session watch

    A fraud desk stores sessionToken, refreshToken, userId and userName from universal login and bank sign-on and alerts when the same customerId mints overlapping sessions from a new device.

  • FIDO enrolment inventory

    Device-security tooling reads aaid, deviceCorrelationId, key id, valid and created from portal FIDO authenticate to watch fingerprint versus passcode enrolment drift per userId.

  • Deposit-opening pipeline

    A branch-ops feed maps each deposit-opening application to customerId plus the chosen productType (checking, savings, CD) and the returned accountId.

Frequently asked questions

What card fields does Discover Mobile expose?

The card-account snapshot returns accountId, customerId, productType, cardType and deviceAccountLastFour — enough to tell it Cashback, Miles and debit products apart without the PAN.

How does Discover Mobile authenticate?

Universal login and bank sign-on issue a sessionToken and refreshToken for a userId / userName. Passwordless sign-in and in-portal step-up use FIDO authenticators (fingerprint or device passcode) identified by aaid and deviceCorrelationId. Protected calls also carry bot-protection sensor data.

Does the surface cover Discover Bank deposits?

Yes. After bank sign-on, deposit opening starts a checking, savings or CD application keyed by customerId and productType and returns the new accountId.

Is this a public Discover developer API?

No. The paths shown are illustrative: they model the kinds of first-party calls the Android app makes after a cardmember or bank customer signs in, and are not a published Open Banking product or Discover's own routes.

Apps similar to Discover Mobile

  • Capital One Mobile — Capital One Mobile is Capital One Services' U.S. app for viewing card and deposit balances, paying bills and loans, redeeming rewards, sending money with Zelle, activating a credit or debit card, and checking a CreditWise credit score.
  • Chase Mobile — Chase Mobile is JPMorgan Chase Bank's U.S. app for checking, savings, credit-card, home, auto and business accounts, with Zelle payments, mobile check deposit, Chase Credit Journey credit score, and in-app card lock and unlock.
  • Amex — The official American Express app lets U.S. cardmembers review balances and Membership Rewards, pay the bill, freeze or unfreeze a card, add a card to Apple Pay, and filter transactions by card.
  • Citi Mobile — Citi Mobile is Citibank's U.S. app for opening a checking or savings account, depositing checks, sending money with Zelle, finding fee-free ATMs, disputing card charges, and viewing a FICO Score for Citi credit-card customers.
  • Bank of America Mobile Banking — Bank of America Mobile Banking manages U.S. checking, savings, credit-card, loan and Merrill investment accounts, with Zelle transfers, photo check deposit, card activation or replacement, and a FICO credit score.
  • Wells Fargo Mobile — Wells Fargo Mobile lets U.S. customers review cash, credit and investment accounts, manage card rewards, deposit checks with the camera, send money with Zelle, pay bills, and view a FICO Credit Score.
  • Ally Bank — Ally: Bank, Auto & Invest is Ally Financial's U.S. app for Ally Bank savings and Spending (checking) accounts, auto-loan payments, free FICO Score updates, and adding cash to a Spending Account at Walmart.
  • SoFi — SoFi is a U.S. digital bank that offers Checking and Savings, a cash-back credit card, personal loans and student-loan refinancing through its mobile and online banking app.

More Banking apps

Topics

  • Discover Mobile API
  • Discover card accountId
  • Discover Bank login
  • deviceAccountLastFour
  • Cashback Bonus productType
  • Discover FIDO aaid
  • sessionToken Discover
  • deposit opening accountId

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

  • NDA + SOW on every engagement
  • Delivery in 3–7 days
  • Payment only after acceptance
  • Work scoped to authorized use

Get a quote