[Bank Integration] DKB sync fails with Enable Banking: "separate device authentication method ... not yet supported"

[rednoxi]

Description

When trying to set up a bank synchronization with the German bank DKB (Deutsche Kreditbank) using the Enable Banking integration, the process fails immediately after selecting the bank.

Other tools using the Enable Banking API (like Actual Budget or the Firefly III Importer) can successfully synchronize with DKB using the decoupled authentication flow (app approval). However, sure throws an error indicating it cannot handle this authentication method yet.

Steps to Reproduce

1. Go to Bank Synchronization / Connections.
2. Choose Enable Banking as the provider.
3. Select DKB (Deutsche Kreditbank) from the list of available banks.
4. Attempt to proceed to the authentication step.

Expected Behavior

The app should redirect to the Enable Banking flow, allowing the user to trigger the decoupled authentication (push notification/app approval) required by DKB.

Actual Behavior

The UI immediately displays the following error message:

"This bank uses a separate device authentication method which is not yet supported. Please add this account manually."

Is there any chance of getting it to work?

Environment / Context

• App Version: v0.7.1-hotfix.1 (2f50e7b) (Docker image ghcr.io/we-promise/sure:stable)
• Deployment: Selfhosted Docker Compose / Portainer on Synology DSM
• Provider: Enable Banking
• Bank: DKB (Germany)

[dosubot]

Good news — this has been fixed! As of a recent update (commit fe47c91 from June 4, 2026), Sure now fully supports decoupled authentication for Enable Banking connections [1].

The app no longer blocks banks that use separate device authentication (push-to-app, photoTAN, chipTAN, etc.). Instead, it automatically selects the best available authentication method per bank, with a priority of REDIRECT → DECOUPLED → EMBEDDED [2].

To resolve this, update your Docker image to the latest stable tag — your current version (v0.7.1-hotfix.1) predates this fix. After updating, DKB should connect successfully through the decoupled flow via Enable Banking's hosted authentication page.

You previously noted in #1650 that other tools (Firefly III, Actual Budget) handle this fine — you were right that this was a Sure-side limitation, not an Enable Banking one [3]. It's now been addressed.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[rednoxi]

@dosu I am already using the latest stable image, but the error persists.

docker compose

version: '3.8'

x-db-env: &db_env
  POSTGRES_USER: ${POSTGRES_USER}
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
  POSTGRES_DB: ${POSTGRES_DB}

services:
  web:
    image: ghcr.io/we-promise/sure:stable
    restart: unless-stopped
    volumes:
      - sure-app-storage:/rails/storage
    ports:
      - "3000:3000"
    environment:
      <<: *db_env
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
      DB_HOST: db
      DB_PORT: 5432
      REDIS_URL: redis://redis:6379/1
      FORCE_SSL: ${FORCE_SSL}
      SELF_HOSTED: ${SELF_HOSTED}
      ONBOARDING_STATE: ${ONBOARDING_STATE}
      DEV_WEBHOOKS_URL: ${DEV_WEBHOOKS_URL}
      RAILS_LOG_LEVEL: ${RAILS_LOG_LEVEL:-info}
      ACTIVE_RECORD_LOG_LEVEL: ${ACTIVE_RECORD_LOG_LEVEL:-info}
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns:
      - 8.8.8.8
      - 1.1.1.1
    networks:
      - sure_net

  worker:
    image: ghcr.io/we-promise/sure:stable
    command: bundle exec sidekiq
    restart: unless-stopped
    volumes:
      - sure-app-storage:/rails/storage
    environment:
      <<: *db_env
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
      DB_HOST: db
      DB_PORT: 5432
      REDIS_URL: redis://redis:6379/1
      FORCE_SSL: ${FORCE_SSL}
      SELF_HOSTED: ${SELF_HOSTED}
      ONBOARDING_STATE: ${ONBOARDING_STATE}
      DEV_WEBHOOKS_URL: ${DEV_WEBHOOKS_URL}
      RAILS_LOG_LEVEL: ${RAILS_LOG_LEVEL:-info}
      ACTIVE_RECORD_LOG_LEVEL: ${ACTIVE_RECORD_LOG_LEVEL:-info}      
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns:
      - 8.8.8.8
      - 1.1.1.1
    networks:
      - sure_net

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - sure-db-data:/var/lib/postgresql/data
    environment:
      <<: *db_env
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - sure_net

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - sure-redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - sure_net

volumes:
  sure-app-storage:
  sure-db-data:
  sure-redis-data:

networks:
  sure_net:

Relevant Logs

I, [2026-06-24T11:19:55.839075 #1]  INFO -- :   Rendered layouts/shared/_htmldoc.html.erb (49.1ms) 
I, [2026-06-24T11:19:55.839931 #1]  INFO -- : {message: "Completed 200 OK in 207.72575300000003ms", event: {http_response_sent: {body: nil, content_length: nil, headers_json: "{\"x-frame-options\":\"SAMEORIGIN\",\"x-xss-protection\":\"0\",\"x-content-type-options\":\"nosniff\",\"x-permitted-cross-domain-policies\":\"none\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"link\":\"\\u003c/assets/tailwind-edb2252f.css\\u003e; rel=preload; as=style; nopush,\\u003c/assets/hotwire_combobox-f35a07fc.css\\u003e; rel=preload; as=style; nopush\",\"content-type\":\"text/html; charset=utf-8\"}", request_id: "e044baa0-c37e-482b-857d-be8e453e620e", service_name: nil, status: 200, duration_ms: 207.72575300000003}}}
I, [2026-06-24T11:19:56.000020 #1]  INFO -- : Finished "/cable" [WebSocket] for IP at 2026-06-24 11:19:55 +0000
I, [2026-06-24T11:19:56.000990 #1]  INFO -- : Turbo::StreamsChannel stopped streaming from ID
I, [2026-06-24T11:19:56.263019 #1]  INFO -- : {message: "Started GET \"/service-worker\"", event: {http_request_received: {body: nil, content_length: nil, headers_json: "{\"Connection\":\"close\",\"Host\":\"HOST\",\"X_Real_Ip\":\"IP\",\"X_Forwarded_For\":\"IP, IP\",\"X_Forwarded_Proto\":\"https\",\"Cache_Control\":\"max-age=0\",\"Dnt\":\"1\",\"Accept\":\"*/*\",\"Service_Worker\":\"script\",\"Sec_Gpc\":\"1\",\"Accept_Language\":\"de-DE,de;q=0.7\",\"Sec_Fetch_Site\":\"same-origin\",\"Sec_Fetch_Mode\":\"same-origin\",\"Sec_Fetch_Dest\":\"serviceworker\",\"Referer\":\"https://HOST/settings/providers\",\"User_Agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\",\"Accept_Encoding\":\"gzip, deflate, br\",\"Priority\":\"u=4, i\",\"Cookie\":\"session_token=; _sure_session=\",\"Version\":\"HTTP/1.1\",\"X_Forwarded_Port\":\"443\"}", host: "HOST", method: "GET", path: "/service-worker", port: 443, query_string: "", request_id: "a856f50b-c699-4a8b-889f-dde31a82aab5", scheme: "https", service_name: nil}}}
I, [2026-06-24T11:19:56.265246 #1]  INFO -- : Processing by PwaController#service_worker as JS
I, [2026-06-24T11:19:56.269132 #1]  INFO -- : {message: "Started GET \"/manifest\"", event: {http_request_received: {body: nil, content_length: nil, headers_json: "{\"Connection\":\"close\",\"Host\":\"HOST\",\"X_Real_Ip\":\"IP\",\"X_Forwarded_For\":\"IP, IP\",\"X_Forwarded_Proto\":\"https\",\"Sec_Ch_Ua_Platform\":\"\\\"Windows\\\"\",\"User_Agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\",\"Sec_Ch_Ua\":\"\\\"Brave\\\";v=\\\"149\\\", \\\"Chromium\\\";v=\\\"149\\\", \\\"Not)A;Brand\\\";v=\\\"24\\\"\",\"Dnt\":\"1\",\"Sec_Ch_Ua_Mobile\":\"?0\",\"Accept\":\"*/*\",\"Sec_Gpc\":\"1\",\"Accept_Language\":\"de-DE,de;q=0.7\",\"Sec_Fetch_Site\":\"same-origin\",\"Sec_Fetch_Mode\":\"cors\",\"Sec_Fetch_Dest\":\"manifest\",\"Referer\":\"https://HOST/settings/providers\",\"Accept_Encoding\":\"gzip, deflate, br\",\"If_None_Match\":\"W/\\\"87cdc6134eb8ce0c4e33d1912e14a055\\\"\",\"Priority\":\"u=2\",\"Version\":\"HTTP/1.1\",\"X_Forwarded_Port\":\"443\"}", host: "HOST", method: "GET", path: "/manifest", port: 443, query_string: "", request_id: "fe460157-7e6c-4003-b0cf-e9929ff50526", scheme: "https", service_name: nil}}}
I, [2026-06-24T11:19:56.270487 #1]  INFO -- : Processing by PwaController#manifest as JSON
I, [2026-06-24T11:19:56.282354 #1]  INFO -- : {message: "Started GET \"/cable\"", event: {http_request_received: {body: nil, content_length: nil, headers_json: "{\"Upgrade\":\"websocket\",\"Connection\":\"upgrade\",\"Host\":\"HOST\",\"X_Real_Ip\":\"IP\",\"X_Forwarded_For\":\"IP, IP\",\"X_Forwarded_Proto\":\"https\",\"Pragma\":\"no-cache\",\"Cache_Control\":\"no-cache\",\"Origin\":\"https://HOST\",\"Sec_Websocket_Version\":\"13\",\"User_Agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\",\"Accept_Encoding\":\"gzip, deflate, br\",\"Accept_Language\":\"de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7,ru;q=0.6\",\"Cookie\":\"session_token=; _sure_session=",\"Sec_Gpc\":\"1\",\"Sec_Websocket_Key\":\"G5Mj624mR1ipy0h5TWl9YQ==\",\"Sec_Websocket_Extensions\":\"permessage-deflate; client_max_window_bits\",\"Sec_Websocket_Protocol\":\"actioncable-v1-json, actioncable-unsupported\",\"Version\":\"HTTP/1.1\",\"X_Forwarded_Port\":\"443\"}", host: "HOST", method: "GET", path: "/cable", port: 443, query_string: "", request_id: "49885632-9a40-4fe6-8c14-e3f8d6a65b21", scheme: "https", service_name: nil}}}
I, [2026-06-24T11:19:56.283849 #1]  INFO -- : Started GET "/cable" [WebSocket] for IP at 2026-06-24 11:19:56 +0000
I, [2026-06-24T11:19:56.284377 #1]  INFO -- : Successfully upgraded to WebSocket (REQUEST_METHOD: GET, HTTP_CONNECTION: upgrade, HTTP_UPGRADE: websocket)
I, [2026-06-24T11:19:56.284901 #1]  INFO -- : {message: "Completed -1  in 2.25541ms", event: {http_response_sent: {body: nil, content_length: nil, headers_json: "{}", request_id: "49885632-9a40-4fe6-8c14-e3f8d6a65b21", service_name: nil, status: -1, duration_ms: 2.25541}}}
D, [2026-06-24T11:19:56.289522 #1] DEBUG -- :   Rendering pwa/service-worker.js
D, [2026-06-24T11:19:56.289719 #1] DEBUG -- :   Rendering pwa/service-worker.js
D, [2026-06-24T11:19:56.289634 #1] DEBUG -- :   Rendering pwa/manifest.json.erb
D, [2026-06-24T11:19:56.289955 #1] DEBUG -- :   Rendering pwa/manifest.json.erb
I, [2026-06-24T11:19:56.290618 #1]  INFO -- :   Rendered pwa/manifest.json.erb (0.6ms)
I, [2026-06-24T11:19:56.292199 #1]  INFO -- : {message: "Completed 200 OK in 22.632271ms", event: {http_response_sent: {body: nil, content_length: nil, headers_json: "{\"x-frame-options\":\"SAMEORIGIN\",\"x-xss-protection\":\"0\",\"x-content-type-options\":\"nosniff\",\"x-permitted-cross-domain-policies\":\"none\",\"referrer-policy\":\"strict-origin-when-cross-origin\",\"content-type\":\"application/manifest+json; charset=utf-8\"}", request_id: "fe460157-7e6c-4003-b0cf-e9929ff50526", service_name: nil, status: 200, duration_ms: 22.632271}}}
I, [2026-06-24T11:19:56.294590 #1]  INFO -- :   Rendered pwa/service-worker.js (4.7ms)
W, [2026-06-24T11:19:56.297005 #1]  WARN -- : Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.
F, [2026-06-24T11:19:56.301076 #1] FATAL -- : ActionController::InvalidCrossOriginRequest (Security warning: an embedded <script> tag on another site requested protected JavaScript. If you know what you're doing, go ahead and disable forgery protection on this action to permit cross-origin JavaScript embedding.)
D, [2026-06-24T11:19:56.318367 #1] DEBUG -- : Turbo::StreamsChannel is transmitting the subscription confirmation
I, [2026-06-24T11:19:56.318612 #1]  INFO -- : Turbo::StreamsChannel is streaming from ID

[dosubot]

Thanks for the additional info, @rednoxi. I found the issue — the decoupled authentication fix (PR #2174, merged June 4) landed in v0.7.2-alpha.3, but it has not yet been included in a stable release [1]. The current stable release is still v0.7.1 [2], which is what you're running.

So even though you're on the latest stable image, you don't have the fix yet because v0.7.2 is still in alpha.

Workaround: Switch your Docker image tag from stable to latest — that will give you v0.7.2-alpha.8 which includes full decoupled authentication support. In your compose file:

image: ghcr.io/we-promise/sure:latest

The fix was tested against VR Bank in Holstein (a DECOUPLED-only bank) and confirmed working, so DKB should work as well.

Alternatively, you can wait for v0.7.2 to reach a stable release, though there's no published timeline for that yet. The latest tag carries alpha builds, so there's a small risk of encountering other in-progress changes — just something to be aware of.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[shrippen]

That is not working either. It gets further in the process but does not complete succesfully. I can enter ID and PW but it should ask me to verify via the banking app. That does not happen and I get thrown back to Sure.

Relevant cleaned log attached.

sure_web 2026-06-24T171122.52158.log