Belvo vs Tink

Belvo

Belvo publishes a 146-operation OpenAPI file, an llms.txt with a Markdown twin of each docs page, and list endpoints with field selection and pages of up to 1,000. Production access needs a sales meeting, a certification call and a paid plan from 1,000 USD a month, and no changelog or maintained SDK was found.

Tink

OAuth client credentials with per-endpoint scopes, token-paged data endpoints and a published MSA, DPA, SLA and sub-processor list. No price is public, live access needs a sales contract, and the API reference has no downloadable spec or published rate-limit numbers.

Belvo

1. Send HTTP Basic with secretId as username and secretPassword as password to https://sandbox.belvo.com, and switch to https://api.belvo.com only with production keys
2. Create links through the Hosted Widget with a token from POST /api/token/, which expires after 10 minutes
3. Read stored data with GET list calls. Each POST retrieval in Brazil counts against monthly Open Finance limits, such as 8 a month per CPF for owners and accounts
4. Retry 50x responses up to five times from a 3 second base with a factor of two, and don't retry 40x apart from too_many_sessions
5. Send Belvo-Idempotency-Key with a UUID when creating a payment intent, and X-Belvo-Request-Mode: async on link deletion to avoid the limit of 5 deletions a minute

Tink

1. Request a client token at https://api.tink.com/api/v1/oauth/token, create a user, request an authorisation grant for that user, then exchange the code for a user token.
2. Renew tokens on a timer. Client tokens last 30 minutes and user tokens two hours, and the client credentials flow returns no refresh token.
3. Send the account holder through Tink Link in a browser. Bank consent cannot be completed by API calls alone.
4. Read transactions from /data/v2/transactions with pageSize up to 100 and follow nextPageToken.
5. Send an Idempotency-Key header on consent and payment writes. Keys are kept for 24 hours.