Belvo vs MX Platform API

Belvo

Belvo publishes a 146-operation OpenAPI file, an llms.txt with a Markdown twin of each docs page, and list endpoints with field selection and pages of up to 1,000. Production access needs a sales meeting, a certification call and a paid plan from 1,000 USD a month, and no changelog or maintained SDK was found.

MX Platform API

Three public OpenAPI files, llms.txt, Markdown docs and a written version policy with 18 months of support and Deprecation and Sunset response headers. No price, client agreement or SLA is published, production keys need MX's approval, every calling IP address must be allowlisted, and the status page records three platform-wide error incidents since 10 July 2026.

Belvo

1. Send HTTP Basic with secretId as username and secretPassword as password to https://sandbox.belvo.com, and switch to https://api.belvo.com only with production keys
2. Create links through the Hosted Widget with a token from POST /api/token/, which expires after 10 minutes
3. Read stored data with GET list calls. Each POST retrieval in Brazil counts against monthly Open Finance limits, such as 8 a month per CPF for owners and accounts
4. Retry 50x responses up to five times from a 3 second base with a factor of two, and don't retry 40x apart from too_many_sessions
5. Send Belvo-Idempotency-Key with a UUID when creating a payment intent, and X-Belvo-Request-Mode: async on link deletion to avoid the limit of 5 deletions a minute

MX Platform API

1. Send Accept: application/json, Accept-Version: v20260929 and Basic auth of client_id:api_key on every call. A missing version returns 406
2. Ask the owner to allowlist the calling machine's static IP in the Client Dashboard first. Other addresses get 403, and some failed authentication returns 404
3. Test against https://int-api.mx.com with institution mxbank, username mxuser and any password. It has no aggregation throttle
4. Set your own id when creating users and members. A repeat returns 409, which makes a retried create safe
5. Expect 202 without an error when a standard aggregation is throttled (three hours by default). Balance checks stop at 5 per member every 2 hours with 429
6. Pass includes[]=merchant or includes[]=category as an array on transaction lists. A comma-separated string returns 400