Open Banking API Integration Guide for US Apps in 7 Steps

Every open banking integration has the same three parts. The hard work is in step 2.

This open banking API integration guide gives you the short version first. Most U.S. teams should start with a data aggregator, not a direct bank connection. You get one API that reaches many banks. Then you add direct bank APIs only where volume or reliability justifies it.

Quick answer

• Decide what you need: account balances, transactions, account and routing numbers, or identity.
• Start with one aggregator's sandbox. Build the full consent flow there first.
• Use OAuth-based bank connections. Never ask users for their bank password.
• Store tokens like secrets. Encrypt them and rotate them.
• Plan for broken connections. Users must be able to reconnect in one tap.
• In the U.S., the CFPB's open banking rule is on hold as of 2026. Build to the FDX standard anyway.

I put this guide together from a law firm's 2026 update on the U.S. rule and from public material on the FDX and FAPI standards, read on November 13, 2026. I have not built against any specific provider's API. This is general information, not legal advice.

What an open banking API actually does

An open banking API lets your app read a person's bank data with their permission. Some APIs also start payments. The person logs in at their bank, approves access, and your app gets a token.

That token is the key. You use it to call the API for balances or transactions. The person can revoke it later, and your access stops.

The old way was "screen scraping." An app took the user's bank password and logged in as them. Token-based access replaces that. It is safer for the user and less fragile for you.

Aggregator or direct bank API?

This is the biggest choice in the whole project. Get it right and the rest is plumbing.

Most teams start in the left box and grow into the middle one.

Factor	Aggregator	Direct bank API
Bank coverage	Many banks, one API	One bank per build
Time to launch	Shorter	Longer, with legal review
Cost model	Per connection or call	Your build and upkeep
Control	Less	More

Well-known U.S. aggregators include Plaid, MX, Finicity (owned by Mastercard), and Akoya. I am not ranking them here. Pricing is usually by quote, so ask each one for its price per connected account and per API call in writing.

How to integrate an open banking API in 7 steps

1. Write down the exact data you need

List each field and the reason you need it. Verifying an account for ACH needs different data than budgeting. Less data means less risk and an easier consent screen.

2. Get sandbox keys and read the auth docs first

Sign up for the provider's developer sandbox. Read the authentication section before the data endpoints. That is where most integrations break.

3. Build the consent flow

The user picks their bank, gets sent to the bank's login, approves access, and comes back to your app. The FDX standard used in the U.S. is built on OAuth 2.0 for this step, according to Stripe's FDX overview. The user never shares their password with you.

4. Exchange and store the token on your server

Your front end receives a short-lived code. Your server swaps it for an access token. Keep tokens server-side only, encrypted at rest, and never in logs.

5. Call the data endpoints

Pull accounts, balances, or transactions. Page through results. Save a cursor so the next sync only fetches what changed.

6. Handle webhooks and errors

Providers send webhooks when new data lands or a connection breaks. Handle the "login required" error with a clear reconnect button. Retry other errors with backoff.

7. Test edge cases, then go live

Test a revoked consent, an expired token, a closed account, and a user with two banks. Then apply for production access. Many providers review your app and use case first.

Open banking API standards to know

• FDX (Financial Data Exchange). The main U.S. data standard. Search summaries I read on November 13, 2026 say the CFPB recognized FDX as a standard-setting body under its rule. I could not open the CFPB page to confirm the details.
• FAPI (Financial-grade API). A security profile of OAuth from the OpenID Foundation. It adds stronger client checks and tighter token rules. FAPI 2.0 is the newer version.
• UK and EU. The UK and EU run their own open banking rules and standards. If you serve users there, read the local standard directly. I did not cover them in depth here.

Where the U.S. open banking rule stands in 2026

The CFPB finalized its Personal Financial Data Rights rule, often called Section 1033, in October 2024. The first compliance date for the largest data providers was April 1, 2026.

That date passed without force. A federal court in the Eastern District of Kentucky enjoined enforcement while the CFPB reconsiders the rule, which it began with an advance notice in August 2025. That is from a Cozen O'Connor update dated April 9, 2026. Search summaries also report that the CFPB sent a new proposal to the White House regulatory review office in August 2026. I did not see a published new rule.

What this means for you: the rules may change, but the direction is clear. Token-based, standard-based access is where banks are going. Build that way now.

Security checklist before launch

• Tokens encrypted at rest, never logged, never sent to the browser.
• Webhook requests verified with the provider's signature.
• Only the scopes you need requested.
• A way for users to disconnect a bank from inside your app.
• Data deleted when the user leaves or revokes access.
• Access to bank data limited to the staff who need it.

If you also handle card data, my PCI DSS compliance checklist for small business covers that side. Business customers may also ask for a security report, so see SOC 2 Type 1 vs Type 2 explained.

Common mistakes

• Asking for every scope. Users drop off at long consent screens.
• Treating a connection as permanent. Consents expire and passwords change. Plan the reconnect flow on day one.
• Skipping the account-verification use case. If you move money, verify the account before your first ACH debit. My ACH vs wire transfer guide explains the rails.
• No cost cap. Per-call pricing adds up when you sync too often. Sync on webhooks, not on a timer.

FAQ

Can I use an open banking API for personal use?

Often yes. Many aggregators offer a free developer sandbox with test banks. Connecting your own real accounts usually needs production access, and terms vary by provider.

Is there a free open banking API?

Sandboxes are commonly free. Production access usually costs money per connection or per call. Ask each provider for written pricing.

Who are the main open banking API providers in the U.S.?

Well-known names include Plaid, MX, Finicity, and Akoya. Some banks also offer direct APIs to approved partners.

What is the open banking API standard in the U.S.?

FDX is the main U.S. standard. It is built on OAuth 2.0, and its security rules draw on the FAPI profile.

Is the CFPB open banking rule in effect?

Not in practice as of this writing. A federal court enjoined enforcement in 2026 while the CFPB reconsiders the rule.

Sources

• Cozen O'Connor, Section 1033 Compliance Date: Open Banking Rule Enjoined and Under Reconsideration (April 9, 2026), read November 13, 2026.
• Federal Register, Required Rulemaking on Personal Financial Data Rights (November 18, 2024), listed for reference.
• Stripe, What is the Financial Data Exchange (FDX)?, via search summary, November 13, 2026.
• OpenID Foundation, FDX and OpenID Foundation announcement, via search summary, November 13, 2026.
• Consumer Finance Monitor (Ballard Spahr), CFPB sends new Section 1033 proposal to OIRA (August 6, 2026), via search summary, November 13, 2026. Page not opened, so not linked.

Last updated: November 13, 2026