Tink vs Yodlee Core API

Tink

OAuth client credentials with per-endpoint scopes, token-paged data endpoints and a published MSA, DPA, SLA and sub-processor list. No price is public, live access needs a sales contract, and the API reference has no downloadable spec or published rate-limit numbers.

Yodlee Core API

A public Swagger 2.0 file covers 98 operations with per-operation error codes, and tokens last 30 minutes and are bound to one end user. No price, service terms, status page, rate limit or SLA is published, there is no official server SDK, and the sandbox is limited to five preconfigured users with sample data.

Tink

1. Request a client token at https://api.tink.com/api/v1/oauth/token, create a user, request an authorisation grant for that user, then exchange the code for a user token.
2. Renew tokens on a timer. Client tokens last 30 minutes and user tokens two hours, and the client credentials flow returns no refresh token.
3. Send the account holder through Tink Link in a browser. Bank consent cannot be completed by API calls alone.
4. Read transactions from /data/v2/transactions with pageSize up to 100 and follow nextPageToken.
5. Send an Idempotency-Key header on consent and payment writes. Keys are kept for 24 hours.

Yodlee Core API

1. Get a token with POST /auth/token, sending Api-Version: 1.1 and the end user's loginName as headers and clientId and secret in a form body. Reuse it for up to 30 minutes
2. Use the admin loginName only for administrative calls such as webhook subscriptions. A token made with a user's loginName reads only that user's data
3. In the sandbox, pick one of the five preconfigured users. Registering new users is not supported there
4. Page GET /transactions with skip and top (1 to 500). Without dates it returns the last 30 days, and at most two years with fromDate and toDate
5. A person must link accounts in FastLink 4 first. Then read GET /providerAccounts for link status before GET /accounts
6. Subscribe to DATA_UPDATES or REFRESH webhooks, or poll GET /dataExtracts/events in windows of at most 60 minutes, and do not poll accounts in a loop