Belvo vs Flinks

Belvo

Belvo publishes a 146-operation OpenAPI file, an llms.txt with a Markdown twin of each docs page, and list endpoints with field selection and pages of up to 1,000. Production access needs a sales meeting, a certification call and a paid plan from 1,000 USD a month, and no changelog or maintained SDK was found.

Flinks

Ten public OpenAPI files, an llms.txt index with Markdown twins and published sandbox keys let an agent start without a signup. Live access needs a one-year contract from $500 a month, keys never expire, no rate-limit numbers are published, and the status page logged 77 incidents in 90 days.

Belvo

1. Send HTTP Basic with secretId as username and secretPassword as password to https://sandbox.belvo.com, and switch to https://api.belvo.com only with production keys
2. Create links through the Hosted Widget with a token from POST /api/token/, which expires after 10 minutes
3. Read stored data with GET list calls. Each POST retrieval in Brazil counts against monthly Open Finance limits, such as 8 a month per CPF for owners and accounts
4. Retry 50x responses up to five times from a 3 second base with a factor of two, and don't retry 40x apart from too_many_sessions
5. Send Belvo-Idempotency-Key with a UUID when creating a payment intent, and X-Belvo-Request-Mode: async on link deletion to avoid the limit of 5 deletions a minute

Flinks

1. Call /GenerateAuthorizeToken with the secret key in flinks-auth-key, then pass the returned token to the Connect iframe or to /Authorize. The token is single-use and expires after 15 minutes.
2. Send the account holder through Flinks Connect in a browser. The API alone cannot complete a first bank login, and sandbox iframes need demo=true.
3. Store the loginId. Call /Authorize with it and MostRecentCached: true for a new requestId each session, because /GetAccountsDetail consumes the requestId.
4. On a 202 from /GetAccountsDetail, poll /GetAccountsDetailAsync every 10 seconds for at most 30 minutes, or ask support to enable webhooks.
5. Route each end user to the instance for their country. A loginId from the Canadian instance is not valid on the US one.