Basiq vs Flinks

Basiq

Ten public OpenAPI files, an llms.txt index with Markdown twins and a free self-serve sandbox let an agent start on test data. Live access needs a 12-month plan with an unpublished platform access fee, no SLA or security.txt was found, and the privacy policy says collected content may be kept indefinitely.

Flinks

Ten public OpenAPI files, an llms.txt index with Markdown twins and published sandbox keys let an agent start without a signup. Live access needs a one-year contract from $500 a month, keys never expire, no rate-limit numbers are published, and the status page logged 77 incidents in 90 days.

Basiq

1. Send the API key verbatim after Basic in the Authorization header of POST /token. Base64-encoding it returns a 400.
2. Send basiq-version: 3.0 on the token request, cache the bearer token for its 60 minutes, and stay under 1,500 token requests per 5 minutes.
3. Send the account holder through the hosted Consent UI in a browser with a CLIENT_ACCESS token bound to their userId. The API alone cannot create a first connection on version 3.0.
4. Poll GET /jobs/{jobId} until verify-credentials, retrieve-accounts and retrieve-transactions all read success before reading accounts or transactions.
5. Follow links.next on GET /users/{userId}/transactions. A page holds at most 500 items, and pending transactions get new ids on each refresh.

Flinks

1. Call /GenerateAuthorizeToken with the secret key in flinks-auth-key, then pass the returned token to the Connect iframe or to /Authorize. The token is single-use and expires after 15 minutes.
2. Send the account holder through Flinks Connect in a browser. The API alone cannot complete a first bank login, and sandbox iframes need demo=true.
3. Store the loginId. Call /Authorize with it and MostRecentCached: true for a new requestId each session, because /GetAccountsDetail consumes the requestId.
4. On a 202 from /GetAccountsDetail, poll /GetAccountsDetailAsync every 10 seconds for at most 30 minutes, or ask support to enable webhooks.
5. Route each end user to the instance for their country. A loginId from the Canadian instance is not valid on the US one.