Building OAuth apps

Building on the Synci API with a personal access token only ever reaches your own account. Register an OAuth app and other Synci users can grant it access to their financial data, through a "Connect to Synci" flow.

It works like authorizing a third-party app to read your Google Drive or GitHub: the user approves your app on a Synci-hosted consent screen, chooses exactly which accounts to share, and can revoke access at any time.

Just need access to your own data? Use the API with a personal access token instead, created under Developers > API tokens in the dashboard.

What your users see

Your app's name and requested permissions are shown up front. Until Synci has reviewed and approved your app, the consent screen tells users that the app hasn't been approved by Synci yet and should only be used for testing, and your logo is only shown once the app is approved.

What you get

• OAuth 2.0 authorization code flow with PKCE, and granular scopes so you only ask for what you need.

• Accounts, balances, transactions and holdings, through the same API that powers the Synci dashboard.

• Per-account consent: the user picks which accounts your app can see, not just which permissions.

• Sensitive identifiers such as IBANs are redacted unless the user explicitly grants them.

Two kinds of apps

You choose the app type when you create the app, and you can't change it later, because it decides who pays for every bank connection the app creates. If you pick the wrong one, create a new app.

• Standard: each of your users has their own Synci account and pays for their own bank connections. This page is about standard apps.

• Managed Users: your users will never hold a Synci account. You register them from your backend, they connect their bank in a Synci-hosted portal, and their connections come out of your plan. See Managed apps.

Testing and review

Create your app under Developers > Apps with Create app. While it hasn't been reviewed, you can use it yourself, plus up to 10 other people. That's enough for a real beta:

• You never use up a slot, and someone who already authorized your app can always authorize it again.

• When someone revokes access, their slot frees up.

• Once the limit is reached, new users see a page saying your app isn't available to new users yet, instead of your consent screen.

When you're ready, choose Submit for review on your app's page. Once Synci approves it, the limit is gone and anyone with a Synci account can connect.

Full documentation

The complete guide covers registering an app, the authorization flow, token exchange and refresh, the full scope table, and the review lifecycle:

👉 https://docs.synci.io/guides/oauth

The documentation site lets you test requests directly from the browser.