To fight that flakey situation of bad APIs, one decides to build a business based on flakey screen scraping instead? With financial information? What could possibly go wrong?

What's the alternative? 95% of banks in the US don't have a dedicated API. If there was no screen scraping whatsoever in the industry, then the fintech market would be much smaller. Any fintech company whose product is centered their users' financial information (and that's most of them) would see their potential customer base, and thus growth potential, sliced in half. On the consumer side of it, if you're Susan and you bank with Northeast Minnesota's Credit Union for Educators, then without screen scraping you are essentially cut off from being able to use the majority of fintech applications out there.

Screen scraping is a terrible compromise for sure, but without it, fintech, and the everyday consumer's ability to more effectively engage with their finances, would be severely neutered. One day, we'll have a rich financial ecosystem where financial institutions, fintechs, and consumers all talk with eachother exclusively through secure, reliable APIs, but until then, the only other alternative is to cripple this entire industry. Or have Congress pass a sweeping PSD2-esque bill, but good luck with that lol

I like the APIs but every 90 days is too many lost users I bet. I think it would be nice if the renewal worked like this -> 1st permissions -> 90 days, 2nd authorisation 180 days, 3rd 365 days and then every renewal after that is a year. Would reduce churn from this by probably 75%...

Even better it would be best if it just emailed you every 90 days asking if you wanted to remove/continue with permissions and did token rolling automatically without the user being involved.

Imagine if you had to renew your account for Facebook every 90 days, I think they would never have built a business.

>Imagine if you had to renew your account for Facebook every 90 days, I think they would never have built a business.

You're not winning any sympathy from me with this at all.

Ahah, but you understand the point ;-)

This is still a ton better than asking the client for credentials and then scraping their logged in bank accounts which is hella creepy.