Member Avatar for harsh5235

I'm not sure where to exactly post this. There is a website called mint.com which let's you enter your username and password for a bank, stock broker, etc and the aggregates all your information from all different accounts onto one screen (balances, transactions, etc).

How does mint.com do this? I highly doubt all the 6,500 financial institutions they support have API's to access. Put another way, if I wanted to aggregate all my private emails on DaniWeb and I had the my username and passsword, how can I do say programatically?
I assume it's something do with AJAX .

Thanks,
Harshal

  • 3 Contributors
  • 2 Replies
  • 100 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Member #380484

Dani AI

Generated

— short, practical answer up front: you cannot reliably do this from in-browser AJAX alone (same-origin and credential security prevent it). Services that aggregate bank accounts or mail today use server-side connectors or official APIs, not a plain client-side script. was right that institutions expose programmatic interfaces in many cases, and was right that automated logins have been used — but there are important technical and legal differences now.

For financial data the common, production-ready approaches are:

  • Use a specialist aggregator (they maintain connectors, handle MFA, normalize responses, and tokenize credentials). Examples of providers and their docs are available from Plaid and Yodlee.
  • Where regulation requires it (EU/UK), banks publish standard APIs under Open Banking / PSD2 so you can get data without emulating a login.

If the goal is email aggregation, use the protocols or APIs the providers offer. Mail servers speak IMAP/POP3, which you can call from a server process if credentials are available, but major providers prefer OAuth flows. Google exposes a Gmail API and requires OAuth2 tokens for third-party access; that is the recommended integration path.

Practical implementation notes and cautions:

  • Do aggregation server-side (not client-side AJAX) because of CORS, session handling, and the need to protect secrets.
  • Avoid brittle parsing with plain regex; use DOM parsing or provider APIs. If you must emulate a browser, use a headless browser and be prepared for frequent breakage.
  • Never store plaintext credentials. Use tokenization, strong encryption, and clear user consent. Watch for captchas, rate limits, and multi-factor authentication.
  • Check terms of service and local laws (PSD2/GDPR or similar). For production projects, using a reputable aggregator is often the fastest, most secure, and most compliant route.

References: Plaid docs (https://plaid.com/docs/), Yodlee developer portal (https://developer.yodlee.com/), Gmail API (https://developers.google.com/gmail/api/), CORS overview (https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS), Open Banking (https://www.openbanking.org.uk/).

Recommended Answers

All 2 Replies

Member Avatar for ~s.o.s~

> I highly doubt all the 6,500 financial institutions they support have API's to access.

Why so? Considering it's money business, I wouldn't be too surprised if mint.com has a way of talking with all of them and that too legally, of course under a sound contract. Anyways, how do you propose to access the account statistics of a bank without the bank knowing about it?

Member Avatar for Member #380484

I agree with ~s.o.s.~ since most reputable Merchant Gateways (online CC processing) have published APIs for people to build software to interface with their services.

On the other hand...I hope mint.com has an amazing seal of approval for trust, else I wouldn't want to give all of my account info to a website ...

On a related note, it is possible to build a user-agent (robot, spider) to go to websites and extract data from their web forms (if the site isn't guarded from such actions) via RegEx or similar means. I've done it with major book vendors getting titles and prices from ISBN numbers. So this is a possible approach in some circumstances.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.