Flinks vs Tink

Flinks

Ten public OpenAPI files, an llms.txt index with Markdown twins and published sandbox keys let an agent start without a signup. Live access needs a one-year contract from $500 a month, keys never expire, no rate-limit numbers are published, and the status page logged 77 incidents in 90 days.

Tink

OAuth client credentials with per-endpoint scopes, token-paged data endpoints and a published MSA, DPA, SLA and sub-processor list. No price is public, live access needs a sales contract, and the API reference has no downloadable spec or published rate-limit numbers.

Flinks

1. Call /GenerateAuthorizeToken with the secret key in flinks-auth-key, then pass the returned token to the Connect iframe or to /Authorize. The token is single-use and expires after 15 minutes.
2. Send the account holder through Flinks Connect in a browser. The API alone cannot complete a first bank login, and sandbox iframes need demo=true.
3. Store the loginId. Call /Authorize with it and MostRecentCached: true for a new requestId each session, because /GetAccountsDetail consumes the requestId.
4. On a 202 from /GetAccountsDetail, poll /GetAccountsDetailAsync every 10 seconds for at most 30 minutes, or ask support to enable webhooks.
5. Route each end user to the instance for their country. A loginId from the Canadian instance is not valid on the US one.

Tink

1. Request a client token at https://api.tink.com/api/v1/oauth/token, create a user, request an authorisation grant for that user, then exchange the code for a user token.
2. Renew tokens on a timer. Client tokens last 30 minutes and user tokens two hours, and the client credentials flow returns no refresh token.
3. Send the account holder through Tink Link in a browser. Bank consent cannot be completed by API calls alone.
4. Read transactions from /data/v2/transactions with pageSize up to 100 and follow nextPageToken.
5. Send an Idempotency-Key header on consent and payment writes. Keys are kept for 24 hours.