Now question time, maybe a bit harsh but you need to think about it.
1. simple one, where is the user authentication flow?
2. the harsh one: as the same problem in OB, just curious what's your thought about building the trust between a third party (TPP or your client in your case) and the end-users? You know in the UK, even OB is relatively mature, you don't see many people willing to login to their bank account via a third party app, even though we all know it's very safe in the technological point of view. But trust is not something you can simply build with technology.