Building OAuth apps
Written By Matias
Last updated 11 days ago
Building on the Synci API with a personal access token only ever reaches your own account. Register an OAuth app and other Synci users can grant it access to their financial data, through a "Connect to Synci" flow.
It works like authorizing a third-party app to read your Google Drive or GitHub: the user approves your app on a Synci-hosted consent screen, chooses exactly which accounts to share, and can revoke access at any time.
Just need access to your own data? Use the API with a personal access token instead, generated in Developers > Tokens in the dashboard.
What your users see
Your app's name, logo and requested permissions are shown up front. Apps Synci has reviewed appear as verified; anything unreviewed carries a clear notice so the user can decide before approving.
What you get
OAuth 2.0 authorization code flow with PKCE, and granular scopes so you only ask for what you need.
Accounts, balances, transactions and holdings, through the same API that powers the Synci dashboard.
Per-account consent: the user picks which accounts your app can see, not just which permissions.
Sensitive identifiers such as IBANs are redacted unless the user explicitly grants them.
Two kinds of apps
This page is about standard OAuth apps, where each of your users has their own Synci account and pays for their own bank connections.
If your users will never hold a Synci account, you want Managed apps instead: you register them from your backend, they connect their bank in a Synci-hosted portal, and their connections come out of your plan.
Full documentation
The complete guide covers registering an app, the authorization flow, token exchange and refresh, the full scope table, and the review lifecycle:
The documentation site lets you test requests directly from the browser.