Powens vs Tink

Powens

Powens documents a REST API with Markdown docs, cursor pagination, date filters and a hard-delete call for connections, under a French payment institution licence. No OpenAPI file, public price, status page, idempotency key or server SDK was found, and live access needs a signed purchase order.

Tink

OAuth client credentials with per-endpoint scopes, token-paged data endpoints and a published MSA, DPA, SLA and sub-processor list. No price is public, live access needs a sales contract, and the API reference has no downloadable spec or published rate-limit numbers.

Powens

1. Ask the owner for the domain name, client ID and client secret from the console. Every call goes to https://{domain}.biapi.pro/2.0
2. Send limit on every transactions list. It is required, at most 1,000, and the next page comes from _links.next.href used as given
3. Enable an account with POST and {"disabled": false} only after the account holder consents. Accounts arrive disabled with no transactions
4. Store the permanent user token as a secret. It does not expire, and the default webhook sends it in the Authorization header
5. Stay under 30 calls a minute in the sandbox and use webhooks in place of polling, as the fair usage policy asks

Tink

1. Request a client token at https://api.tink.com/api/v1/oauth/token, create a user, request an authorisation grant for that user, then exchange the code for a user token.
2. Renew tokens on a timer. Client tokens last 30 minutes and user tokens two hours, and the client credentials flow returns no refresh token.
3. Send the account holder through Tink Link in a browser. Bank consent cannot be completed by API calls alone.
4. Read transactions from /data/v2/transactions with pageSize up to 100 and follow nextPageToken.
5. Send an Idempotency-Key header on consent and payment writes. Keys are kept for 24 hours.