Credentials

Every connection moves through five stages: authenticate → exchange → access → renew → disconnect. What happens to credentials depends on the route.

Bank-hosted sign-in (open banking or a partnership)

The person signs in on the bank’s own page. Link never receives the credentials. The bank issues an access token covering only the approved data. Access usually expires after a set period and is approved again at the bank.

Link Direct, where the bank supports renewal

1. Authenticate. The person signs in within Link’s flow, using the same sign-in they use for their bank online.
2. Exchange. Link exchanges the credentials for an access or session token. The credentials pass through Maxint’s servers and are held in memory only for the exchange. They aren’t kept by default, and are never written to logs.
3. Access. Data is fetched with the token.
4. Renew. Link renews the token through the bank’s own refresh mechanism, without needing the password.
5. Disconnect. Link stops using the token, deletes it immediately and asks the bank to cancel it where the bank supports that.

Link Direct, where the bank can’t renew access (the exception)

Some banks have no usable way to renew access. Keeping those connections working means Link retains the credentials so it can sign in again. The person is told before connecting and must acknowledge it, and they can choose another route instead.

Note

Retained credentials are stored encrypted with separate keys, used only to keep that connection working, and deleted immediately when the person disconnects, or after 90 days in which the connection isn’t used. See the Link Security page for the full list of triggers and protections.

Third-party providers

Plaid, Stripe, Teller and GoCardless handle credentials under their own policies. Link shows each provider’s sign-in method and links to its documentation.