How open banking APIs actually work

Open banking lets you share your bank data with other apps — budgeting tools, lenders, accounting software — without handing over your password. In the UK and EU it is backed by regulation that requires banks to provide secure APIs. Here is what happens when you tap "connect".

The flow

The app asks for consent. It tells you what it wants to access (balances, transactions, or permission to make a payment) and for how long.
You are redirected to your bank. You log in with your bank's own app or website — the third-party app never sees your credentials.
The bank issues a token. After you approve, the bank gives the app an access token limited to exactly what you agreed.
The app calls the API. Using the token, the app can fetch your data until the consent expires or you revoke it.

GET /accounts/{id}/transactionsjson

{
  "Data": {
    "Transaction": [
      {
        "TransactionId": "txn_8f2c",
        "BookingDateTime": "2026-10-02T09:14:00+00:00",
        "Amount": { "Amount": "4.20", "Currency": "GBP" },
        "CreditDebitIndicator": "Debit",
        "TransactionInformation": "COFFEE CORNER"
      }
    ]
  }
}

A simplified example of the kind of response a read-only transactions endpoint returns.

What the app can't do

With read-only access, an app can see but not move money. Payments require a separate, explicit authorisation for each payment (or a clearly defined recurring mandate), approved in your bank's app.

Staying in control

Consents for account data expire and must be renewed periodically.
You can see and revoke connected apps in your bank's settings.
Only regulated providers can use these APIs — check the provider's registration before connecting.