From signup to live data in minutes.

Full API reference and SDK guides. Sandbox access requires no accreditation.

Quickstart

Create an account

Link a bank account

Verify your organisation, then create a Link Request: a hosted page where your customer sees who you are and authorises access to their bank account.

Fetch data

Use your API key to call /accounts, /transactions, or /balance.

Build your product

We maintain the bank integrations. You focus on the experience.

Core concepts

Connection

A user-authorised link between Banklink and a specific bank account.

Link Request

A hosted flow where your customer connects their bank account for ongoing access. Banklink stores their login, encrypted.

Access Request

A hosted flow where your customer shares their transactions once. Nothing is stored in Banklink.

Pulse

A scheduled job that syncs transactions and delivers them to your dashboard, a webhook, or email.

Destination

Where a Pulse delivers data — dashboard storage, a webhook URL, or an email address.

Link and access requests

Before your customer enters their banking login, the hosted page shows your name, logo and verified domain, what you receive, and how their data is handled. To send live requests, verify your organisation first: complete your link profile, prove you control your domain, and disclose Banklink in your privacy policy. See the requirements. Test keys work before you are verified.

Set redirect_url (https on your verified domain) to bring the customer back when they finish or cancel. Banklink adds banklink_status (success, cancelled, expired, revoked or already_completed) and banklink_reference. Treat the redirect as a hint for your UI: the signed webhook is the source of truth.

Webhooks

Pulses, link requests and access requests can POST transactions to a webhook. Each delivery is JSON with an event field (link_request.completed, access_request.completed or pulse.delivered) and carries three headers: Banklink-Signature, Banklink-Event and Banklink-Delivery (a unique id you can use to ignore duplicates).

Banklink-Signature: t=<unix seconds>,v1=<hex>. The v1 value is an HMAC-SHA256 of {t}.{raw request body}, keyed with the signing secret in Settings → Webhook signing. Verify it against the raw body, compare in constant time, and reject timestamps older than five minutes. After you rotate the secret, the old one also signs for 24 hours, so the header can carry two v1 values.

Webhooks for live link and access requests must be https URLs on your verified domain.

// Node: npm install @banklink/sdk

import { constructWebhookEvent } from '@banklink/sdk';

app.post('/banklink', express.raw({ type: 'application/json' }), (req, res) => {

const event = constructWebhookEvent(req.body, req.get('Banklink-Signature'), process.env.BANKLINK_WEBHOOK_SECRET);

res.sendStatus(200);

});

# Python: pip install banklink

from banklink import construct_event

event = construct_event(request.get_data(), request.headers.get("Banklink-Signature"), WEBHOOK_SECRET)

Next steps

API reference

Endpoints, authentication, SDKs, and sandbox details.

Guides & articles

Connecting bank accounts, reading balances, and open banking in South Africa.

For integration support, reach us at support@banklink.co.za.