Does my server ever see the user's bank credentials?

No. Credentials, OAuth redirects, and MFA challenges are handled inside the Link flow on FeelConnect's origin. Your server creates a link token and later exchanges a public token; neither carries a credential. Provider tokens are encrypted with AES-256-GCM at rest, and the access tokens you hold are stored here only as SHA-256 hashes with a display prefix.

Which products can I ask consent for?

Nine: transactions, balances, identity, income, assets, investments, liabilities, recurring, and crypto. The products array on link/token/create becomes the consent screen the user sees and the permission set stored on the item. Reading a product the user did not consent to returns permission_error with code product_not_consented, not an empty array.

What happens when a connection breaks?

The item moves to login_required or error, an item.error webhook fires, and subsequent reads surface the state on the item object. You reopen Link in update mode with update_item_id set; the user re-authenticates and the same item resumes. Update mode needs no token exchange — exchanging one anyway rotates the item's access token and tells you so with rotated: true.

How do bank consent screens work inside a modal?

They do not, and we do not pretend otherwise. Bank consent pages refuse to render in a frame, so the Link modal hands off to a popup window — or, when popups are blocked, asks the embedding page to navigate the whole tab — and resumes automatically when the bank returns the user.

Where do institution logos come from?

They are fetched once and served from our own origin. If the Link modal loaded logos from a third-party CDN, that CDN would learn every user's IP address and which bank they were about to connect. Institutions with no logo on disk render a brand-coloured monogram instead, and the simulated sandbox institutions always use monograms so demo data never wears a real brand's mark.

Is FeelConnect regulated as an account information service provider?

FeelConnect makes no regulatory claim of its own. Connectors carry their own permissions: GoCardless Bank Account Data, for example, operates under GoCardless's PSD2 licence, and using it means working under their permission rather than obtaining your own AISP authorisation. Your regulatory position depends on your jurisdiction, your product, and the provider you enable — check it with counsel rather than with a marketing page.

open banking

One Link flow in, one API out.

Institution search, OAuth, credential forms, MFA challenges, account selection, and scoped consent all happen inside Link. Your server handles two tokens and then reads normalized accounts, balances, and connection state over POST + JSON.

Get a sandbox key Link reference

endpoints

The connection surface.

Every endpoint is POST with a JSON body and bearer secret-key auth. Errors come back as a typed envelope with a request id.

POST/v1/link/token/createMint a 30-minute link_token for one end user, scoped to the products you are asking consent for.
POST/v1/link/token/exchangeTurn the public_token Link hands back into a persistent access_token and item_id.
POST/v1/institutions/searchSearch the catalog by name and search terms, filtered by type and country code.
POST/v1/institutions/get_by_idOne institution: type, countries, colour, monogram, logo, OAuth and MFA flags.
POST/v1/items/getThe connection's state: institution, connector, status, consented products, last successful sync.
POST/v1/items/refreshAsk the connector for fresh data outside the normal sync cadence.
POST/v1/items/removeRevoke the access token and delete the stored connection.
POST/v1/accounts/getEvery account on the item with its cached balances and verification status.

requests

Search the catalog, then connect an account.

Both samples run against the shipped API. Swap the key for one of your own from the dashboard.

# Browse the catalog the Link modal searches. Filter by country and type.
curl https://connect.feels.money/v1/institutions/search \
  -H "Authorization: Bearer $FEELCONNECT_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "monzo",
    "types": ["bank"],
    "country_codes": ["GB"]
  }'

institutions/search matches on the institution name and its search terms, orders by the same popularity that ranks Link’s own results, and caps at 20 institutions per call. An empty query browses the most popular institutions for the filters you passed. The catalog it reads is the one published at /institutions.

the flow

What Link does so you do not have to.

Five screens, one postMessage protocol, and no credential ever reaching your infrastructure.

Institution search. Typed groups — banks, payment apps, investments, crypto, business — with real marks served from our origin and monograms as the fallback.
Authentication. Whatever the connector needs: an OAuth hand-off, a credential form, a wallet address, or a CSV / OFX / QFX upload. The step type is decided by the connector, not by your code.
MFA. Code or question challenges loop until the connector is satisfied. In the sandbox, user_mfa / pass_good with code 1234 exercises the whole path.
Account selection. The user picks which accounts to share. Everything else on the login stays invisible to you.
Consent. The product scopes from your link_token are shown in plain language before anything is shared, and the accepted set is stored on the item and enforced on every read.
Hand-back. The SDK verifies both the origin and the source window of every message, then delivers fc:success { public_token, metadata } to your callback.

catalog

What is in the institution catalog.

Counted from the live catalog this deployment serves — the same rows institutions/search returns.

institutions: 938
countries: 61
connectors: 17
products: 9

The twelve largest markets in the catalog by institution count. Being listed means the institution is searchable and routable — connecting it live still needs the relevant provider credentials.
Country	Institutions in the catalog
United States	564
United Kingdom	104
Canada	32
Germany	32
Australia	31
European Union	25
India	23
France	20
Spain	18
Italy	15
Netherlands	15
Singapore	14

What live coverage actually depends on

FeelConnect does not hold bank connections of its own. Every institution in the catalog carries an ordered chain of connectors, and live traffic goes to the first one whose credentials are present in the deployment you are calling.

Some connectors an operator can switch on alone in minutes — GoCardless Bank Account Data (UK and EU banks, free self-signup under their PSD2 licence), Coinbase, Kraken, PayPal, public-address crypto wallets, and CSV / OFX / QFX import. Others need a signed business relationship before they will serve production data, including Plaid, MX, Finicity, Akoya, and Stripe Financial Connections. Where an institution has no enabled connector, a live call returns provider_error rather than pretending.

The sandbox is the exception and it is always on: test keys resolve to the simulated network regardless of credentials, so the full integration is buildable on day one. See going live for the provider-by-provider breakdown.

handling

How the sensitive parts are handled.

Stated as mechanisms rather than badges: these are properties of the code, not certifications.

Provider tokens, stored access tokens, and webhook secrets are encrypted with AES-256-GCM at rest.
API keys and item access tokens are kept as SHA-256 lookup hashes with a display prefix and last four — the full value exists once, at creation.
Webhook deliveries are signed FC-Signature: v1=hex(hmacSHA256(secret, "timestamp.body")) and must be rejected outside a five-minute window. Retries run at 0s, 1m, 5m, 30m, and 2h.
Institution logos are served from this origin, so displaying one never reveals a user’s IP — or which bank they are about to connect — to a third-party CDN.
Test keys can never reach a real institution: the registry resolves the test environment to the sandbox regardless of what credentials exist.

The sandbox is the honest place to start: 24 months of deterministic history per item, every product, OAuth and MFA simulation, and no approval queue. Environments and sandbox covers the test credentials and how items are seeded.

faq

Questions developers actually ask.

keep reading