You would have to proxy the requests on your server, enforce read-only on your public facing API, and keep the token sever-side for talking to the bank?

Put varnish in front of your API to act as a caching layer and prevent anyone from causing your server to overload the bank API.