Basiq vs Belvo

Basiq

Ten public OpenAPI files, an llms.txt index with Markdown twins and a free self-serve sandbox let an agent start on test data. Live access needs a 12-month plan with an unpublished platform access fee, no SLA or security.txt was found, and the privacy policy says collected content may be kept indefinitely.

Belvo

Belvo publishes a 146-operation OpenAPI file, an llms.txt with a Markdown twin of each docs page, and list endpoints with field selection and pages of up to 1,000. Production access needs a sales meeting, a certification call and a paid plan from 1,000 USD a month, and no changelog or maintained SDK was found.

Basiq

1. Send the API key verbatim after Basic in the Authorization header of POST /token. Base64-encoding it returns a 400.
2. Send basiq-version: 3.0 on the token request, cache the bearer token for its 60 minutes, and stay under 1,500 token requests per 5 minutes.
3. Send the account holder through the hosted Consent UI in a browser with a CLIENT_ACCESS token bound to their userId. The API alone cannot create a first connection on version 3.0.
4. Poll GET /jobs/{jobId} until verify-credentials, retrieve-accounts and retrieve-transactions all read success before reading accounts or transactions.
5. Follow links.next on GET /users/{userId}/transactions. A page holds at most 500 items, and pending transactions get new ids on each refresh.

Belvo

1. Send HTTP Basic with secretId as username and secretPassword as password to https://sandbox.belvo.com, and switch to https://api.belvo.com only with production keys
2. Create links through the Hosted Widget with a token from POST /api/token/, which expires after 10 minutes
3. Read stored data with GET list calls. Each POST retrieval in Brazil counts against monthly Open Finance limits, such as 8 a month per CPF for owners and accounts
4. Retry 50x responses up to five times from a 3 second base with a factor of two, and don't retry 40x apart from too_many_sessions
5. Send Belvo-Idempotency-Key with a UUID when creating a payment intent, and X-Belvo-Request-Mode: async on link deletion to avoid the limit of 5 deletions a minute