My bank fio.cz provides it's own user rest api, so that before you create an api access key, you can select which accounts it applies to and if it's read only access or not. I don't understand why there aren't more banks doing something like this. Btw the bank also offers PSD2, but I haven't looked into that so far, and I'm not sure if it's actually directly useful for a client. https://www.fio.cz/bank-services/internetbanking-api