API keys
An API key lets software of your own — a script, an internal tool, something your team has built — connect to your BankStmt account and work with your data automatically, without anyone signing in by hand each time. If you only use the app, or only the built-in connectors under Settings → Integrations, you don't need one.
You'll find it as a tab under Settings.
The REST API and webhooks are included on the Professional and Business plans. On Free and Starter the tab explains that and offers an upgrade. See Plans & limits.
When you create a key, the secret appears a single time. For your security, BankStmt does not keep a copy — not even support can look it up later. Copy it somewhere safe straight away. If you lose it, just remove that key and create a new one.
What it shows
A list of the keys you've created, each with:
| Column | What it holds |
|---|---|
| Name | The label you gave the key, so you can tell your connections apart. |
| Key | A short, non-secret snippet that helps you recognise which key is which. |
| Access | Whether the key can only read your data, or also add to it. |
| Last used | When the key was last used, or Never. |
| Status | Active, Revoked, or Expired. |
What you can do
| Action | What it does |
|---|---|
| Create a key | Sets up a new connection, with a name and a level of access. |
| Choose access | Lets a key read your data only, or also upload statements and register webhooks. Pick read-only unless the tool genuinely needs to add data. |
| See when it was last used | Makes it easy to spot connections you no longer use and remove them. |
| Remove a key | Stops that connection working, straight away. |
How to use it
- Open Settings → API keys.
- Select Create key.
- Give it a name that says where it will be used — for example, the system you're connecting.
- Choose whether it can read your data only, or also write.
- Select Create, then copy the secret and store it somewhere safe. This is the only time it's shown.
- Use it as a bearer token from your own code, following the developer documentation.
To end a connection, remove its key. Anything still using it stops working immediately.
Good to know
- Keep the secret private — treat it like a password. Anyone who has it can reach your data.
- Removing a key is instant and final. If you remove one by mistake, create a new one and update the tool that used it.
- A key can reach everything in your account. The read/write choice controls what it can do, not which parts of your account it can see. Create a separate key for each tool, so you can end one connection without affecting the others.
- Each key is rate-limited to 120 requests a minute.
- Whatever you connect counts towards your plan's monthly page allowance, the same as using the app does. See Plans & limits.
- Webhooks — signed notifications when a statement completes or fails — are managed with the same keys. See Integrations, open banking & API.
- The technical guide — endpoints, request and response shapes, signature verification — lives in the developer documentation, which requires a developer sign-in.