Basiq vs Tink

Basiq

Ten public OpenAPI files, an llms.txt index with Markdown twins and a free self-serve sandbox let an agent start on test data. Live access needs a 12-month plan with an unpublished platform access fee, no SLA or security.txt was found, and the privacy policy says collected content may be kept indefinitely.

Tink

OAuth client credentials with per-endpoint scopes, token-paged data endpoints and a published MSA, DPA, SLA and sub-processor list. No price is public, live access needs a sales contract, and the API reference has no downloadable spec or published rate-limit numbers.

Basiq

1. Send the API key verbatim after Basic in the Authorization header of POST /token. Base64-encoding it returns a 400.
2. Send basiq-version: 3.0 on the token request, cache the bearer token for its 60 minutes, and stay under 1,500 token requests per 5 minutes.
3. Send the account holder through the hosted Consent UI in a browser with a CLIENT_ACCESS token bound to their userId. The API alone cannot create a first connection on version 3.0.
4. Poll GET /jobs/{jobId} until verify-credentials, retrieve-accounts and retrieve-transactions all read success before reading accounts or transactions.
5. Follow links.next on GET /users/{userId}/transactions. A page holds at most 500 items, and pending transactions get new ids on each refresh.

Tink

1. Request a client token at https://api.tink.com/api/v1/oauth/token, create a user, request an authorisation grant for that user, then exchange the code for a user token.
2. Renew tokens on a timer. Client tokens last 30 minutes and user tokens two hours, and the client credentials flow returns no refresh token.
3. Send the account holder through Tink Link in a browser. Bank consent cannot be completed by API calls alone.
4. Read transactions from /data/v2/transactions with pageSize up to 100 and follow nextPageToken.
5. Send an Idempotency-Key header on consent and payment writes. Keys are kept for 24 hours.