wisdomtt

Thanks!

We pull up to 15 years of transaction history which we believe should cover the majority, if not the entirety of a users transaction history.

We agree, we would MUCH rather be implementing sanctioned integrations and we will go the sanctioned route whenever possible. We're trying to establish relations with these big institutions to push them towards sanctioned access and also get feedback on what would be best practices for integrating with them. Our bet is that the industry in the long-run will be moving towards enabling sanctioned access delegation. That being said, at the end of the day users want to export data from their brokerage apps and they want the means of exporting this data to be stable.

When a consumer logs in with our application we save their access/refresh tokens. We can use these keys to keep a long lived session such that an app using our API should never have to re-auth their users again. The only instance where a session may need to re-auth is if their password gets changed, or some equivalent account modification such that the long lived refresh tokens expire. We specifically chose to integrate with institutions with refreshable tokens directly in order to maintain secure non-buggy connections.