Skip to main content

PSD2 / Open-Banking – Future Dream Goal (TODO)

Status: Not implemented. Tracking only.
See also: Finance (manual-first budgeting is live; bank linking is not).

Goal​

Enable bank account data via a third-party PSD2 aggregator so users can sync transactions automatically. Manual-first remains the primary flow; bank linking is optional.

Candidate providers​

  • Nordigen / GoCardless Bank Account Data (free tier available)
  • TrueLayer
  • Tink

Scope (when implemented)​

  1. Consent flow – User initiates “Connect bank”; redirect to provider; consent; return with authorization code.
  2. Token storage – Store refresh/access tokens securely (encrypted at rest); associate with user and provider.
  3. Sync jobs – Background worker: periodic sync per connection; fetch transactions for linked accounts; respect rate limits and provider errors.
  4. Idempotent ingestion – Deduplicate by (externalId, accountId); map provider accounts to our Account model; create/update transactions without duplicates.
  5. Webhooks or polling – Prefer webhooks if provider supports; else polling with backoff.

Data model (placeholder)​

  • BankConnection – userId, provider, accessToken (encrypted), refreshToken, expiresAt, consentScope, status.
  • BankAccount (provider view) – connectionId, externalId, name, type, currency; link to our Account.id (optional 1:1 or manual link).
  • SyncJob – connectionId, startedAt, completedAt, status, lastTransactionCursor, errorMessage.

Product caveats​

  • Credit cards and mortgages may be inconsistent across banks/providers.
  • Coverage and reliability vary by country and institution.
  • No implementation code beyond interfaces/placeholders behind a feature flag until this is prioritized.

Implementation notes​

  • New routes: e.g. GET/POST /bank-connections, POST /bank-connections/:id/sync.
  • Store raw provider payload (or digest) for audit and debugging.
  • Rate limits and retry/backoff per provider API.