# Missing token_type field breaks consent finalisation

> Suncorp and ING return token responses without the token_type field, causing consent finalisation to fail with a parse exception.

- Type: Known Data Holder Issue (upstream — originates at the data holder, not openfeed)
- Data holder: Suncorp, ING
- Sector: Banking
- Issue type: Partial implementation
- Severity: High
- Status: Investigating
- Affected scopes: openid
- openfeed action: Monitoring
- First observed: 2026-07-23
- Last verified: 2026-07-23
- Canonical: https://openfeed.au/status/data-holders/suncorp-ing-token-type-missing

---

## What's happening

Suncorp and ING return token endpoint responses that omit the `token_type` field. RFC 6749 §5.1
defines `token_type` as a required field in a successful token response, and CDR inherits this
requirement. When the field is absent, consent finalisation fails with a parse exception on the
token response.

This originates entirely upstream at the affected data holders.

## Impact

Consumers attempting to link a CDR data source at Suncorp or ING cannot complete account
linking — consent finalisation fails with no recovery path available to them.

## Current status

openfeed is currently determining an appropriate workaround. This page will be updated as our
investigation progresses.