Missing token_type field breaks consent finalisation

What’s happening

Suncorp and ING return token endpoint responses that omit the token_type field. RFC 6749 §5.1 defines token_type as a required field in a successful token response, and CDR inherits this requirement. When the field is absent, consent finalisation fails with a parse exception on the token response.

This originates entirely upstream at the affected data holders.

Impact

Consumers attempting to link a CDR data source at Suncorp or ING cannot complete account linking — consent finalisation fails with no recovery path available to them.

Current status

openfeed is currently determining an appropriate workaround. This page will be updated as our investigation progresses.