Why You Can't Just Call a Bank API: Open Banking Authentication Explained for Developers

Short summary

Open banking API authentication in the EU/UK requires three stacked layers: an eIDAS QWAC certificate (€2k–€10k/yr), OAuth 2.0 with Strong Customer Authentication, and per-bank API normalization. Most developers and small teams bypass this complexity by using aggregators like Plaid, Tink, or TrueLayer, which abstract all three layers behind a single bearer-token API. A newer category of certificate-free aggregators offers usage-based pricing from a few euros/month, making it viable for hobby projects and SMBs.

• •Direct bank API access requires eIDAS certificates costing €2k–€10k/yr plus months of regulatory registration
• •OAuth 2.0 with SCA and per-bank API differences add further complexity
• •Aggregators like Plaid and Tink abstract all layers; certificate-free options start at a few euros/month

Generated with AI, which can make mistakes.