Yodlee

Before touching the API Connector, you need a safe place to store your Yodlee cobrand credentials. These are your platform-level API credentials — the cobrand login and cobrand password — that you received when you registered at developer.yodlee.com. In Bubble, go to your Data tab and create a new Data type called 'YodleeConfig' (or 'AppSettings' if you already have one). Add two fields: 'cobrand_login' (Text) and 'cobrand_password' (Text). Mark both fields as Private in your Privacy rules so they are never exposed to end users. Create one record in this table manually using Bubble's database editor and populate both fields with your Sandbox credentials. Alternatively, you can store the cobrand password as an API Connector shared header value with the Private checkbox enabled — this prevents it from appearing in Bubble's editor to anyone who isn't the app owner. Now install the API Connector. Go to Plugins tab → Add plugins → search for 'API Connector' (by Bubble) → Install. Once installed, click 'Add another API', name it 'Yodlee', and set the Base URL to your Sandbox endpoint: https://sandbox.api.yodlee.com/ysl Add two shared headers that will be populated dynamically at call time: - 'cobSession' — set value to a parameter placeholder like [cobSession], enable the Private checkbox - 'userSession' — set value to [userSession], enable the Private checkbox At this stage you are not hardcoding the token values (they change every 30 minutes). Instead, each API call will supply the current token values as parameters fetched from the Bubble database. Save your API configuration. You now have the foundation to add individual API calls in later steps.

1{
2  "base_url": "https://sandbox.api.yodlee.com/ysl",
3  "shared_headers": [
4    {
5      "key": "cobSession",
6      "value": "[cobSession]",
7      "private": true
8    },
9    {
10      "key": "userSession",
11      "value": "[userSession]",
12      "private": true
13    }
14  ]
15}

The cobSession token is the foundation of all Yodlee API access. It authenticates your platform (not individual users) and must be refreshed every ~30 minutes. You will build a Backend Workflow that mints a new cobSession and stores it in your Bubble database. First, add the cobSession minting API call to your Yodlee API Connector. Click your 'Yodlee' API → Add a call → name it 'Mint CobSession'. Set Method to POST and Path to /cobrand/login. Important: this call uses form-encoded body (not JSON). Set body type to 'Form' and add these fields: - cobrand.cobrandLogin: [cobrand_login] (make this a parameter) - cobrand.cobrandPassword: [cobrand_password] (make this a parameter) Do NOT include the shared cobSession or userSession headers in this specific call — they don't exist yet at the time this call runs. You may need to override the shared headers to empty strings for this call. Click 'Initialize call' and supply your actual Sandbox cobrand login and password as parameter values. A successful response returns a JSON with cobrandConversationCredentials.sessionToken — this is your cobSession value. Now go to Backend Workflows (in your Bubble editor, enable API Workflows under Settings → API → 'This app exposes a Workflow API'). Create a new Backend Workflow named 'Yodlee_MintCobSession'. Add a 'Call API' step using your new 'Mint CobSession' call, passing the cobrand credentials from your YodleeConfig data record. Add a second step: 'Make changes to a thing' — update your YodleeConfig record, set a 'cob_session_token' Text field to the API response's cobrandConversationCredentials.sessionToken, and set 'cob_session_created_at' to Current date/time. Schedule this Backend Workflow to run automatically every 25 minutes using Bubble's 'Schedule API workflow' with a recurring event — this ensures the cobSession never expires mid-user-session. Note: scheduled recurring Backend Workflows require a paid Bubble plan.

1POST /cobrand/login
2Content-Type: application/x-www-form-urlencoded
3
4cobrand.cobrandLogin=your_cobrand_login
5&cobrand.cobrandPassword=your_cobrand_password
6
7// Successful response:
8{
9  "cobrandConversationCredentials": {
10    "sessionToken": "08_....LONG_TOKEN_STRING....",
11    "locale": "en_US"
12  },
13  "applicationId": "your-app-id"
14}

Every end user in your Bubble app who uses Yodlee financial features must be registered as a user in Yodlee's system. This registration uses the cobSession token and creates a Yodlee username/password pair that you store in the user's Bubble record. The userSession is then minted from those credentials. Add two API calls to your Yodlee API Connector: Call 1 — 'Register User': POST /user/register. This call needs the cobSession header (already in your shared headers). Body (JSON type): { "user": { "loginName": "[yodlee_username]", "password": "[yodlee_password]", "email": "[email]", "preferences": { "locale": "en_US" } } } Generate a unique yodlee_username for each Bubble user — a safe pattern is 'user_' + Bubble's unique ID (e.g., '1234567890'). Generate a strong random password and store both in the User's data record. Call 2 — 'Mint User Session': POST /user/login. Body (JSON): { "user": { "loginName": "[yodlee_username]", "password": "[yodlee_password]" } } The cobSession header must be present and valid. Response returns userSession.sessionToken — your per-user token. Build two Backend Workflows: - 'Yodlee_RegisterUser': runs once per new user, calls Register User, stores the returned Yodlee user ID in the User record. - 'Yodlee_MintUserSession': takes current User as input, calls Mint User Session using stored credentials + current cobSession, stores returned userSession token and 'user_session_created_at' timestamp in the User's record. Trigger 'Yodlee_RegisterUser' from your Bubble signup workflow (after your normal user creation). Trigger 'Yodlee_MintUserSession' whenever a user navigates to a page that shows financial data, checking first if their existing userSession is older than 25 minutes.

1// Register User
2POST /user/register
3Headers: { cobSession: "<current-cobSession-from-db>" }
4Body:
5{
6  "user": {
7    "loginName": "user_1234567890",
8    "password": "SecurePass!2024",
9    "email": "user@example.com",
10    "preferences": { "locale": "en_US" }
11  }
12}
13
14// Mint User Session
15POST /user/login
16Headers: { cobSession: "<current-cobSession-from-db>" }
17Body:
18{
19  "user": {
20    "loginName": "user_1234567890",
21    "password": "SecurePass!2024"
22  }
23}
24// Response: { "user": { "session": { "userSession": "09_....TOKEN...." } } }

FastLink is Yodlee's hosted bank-linking widget — a Yodlee-owned webpage where users enter their banking credentials to authorize data access. You cannot build your own bank login UI; you must use FastLink. The good news is that FastLink handles all the credential security, multi-factor authentication, and institution-specific login flows for you. To open FastLink, you need a FastLink-specific access token. This is different from the userSession — you must request it separately. Add an API call to your Yodlee API Connector: - Name: 'Get FastLink Token' - Method: POST - Path: /user/accessTokens - Body (JSON): { "appIds": ["your-app-id"] } - Headers: both cobSession and userSession must be valid (use your stored values) The response returns a token value inside the user.accessTokens array. This is your FastLink token. Now build the Bubble workflow for the 'Connect Bank Account' button: 1. Trigger Backend Workflow 'Yodlee_MintUserSession' (if userSession is stale) 2. Call 'Get FastLink Token' API call 3. Construct the FastLink URL: https://fl4.sandbox.yodlee.com/authenticate/restserver/?token=[fastlink_token] — always verify the current FastLink URL format in your Yodlee Sandbox documentation, as it can change between Yodlee platform versions 4. Use Bubble's 'Open an external URL' action with this URL, set to 'open in a new tab' or 'open in a popup' (a popup keeps the user in your app context) When FastLink completes, the widget sends a postMessage to the parent window. To capture this in Bubble, you can add an HTML element with JavaScript that listens for postMessage events from the FastLink domain and triggers a Bubble backend call when bank linking completes. The Toolbox plugin (free, from Bubble's marketplace) allows you to run JavaScript from workflows — use it to set a page state variable when FastLink's completion event fires. Alternatively, add a 'Refresh My Data' button that the user clicks after completing FastLink — trigger the 'Fetch Accounts' workflow described in the next step.

1// Get FastLink Token
2POST /user/accessTokens
3Headers:
4  cobSession: <current-cobSession-from-db>
5  userSession: <current-userSession-from-db>
6Body: { "appIds": ["your-app-id"] }
7
8// Response:
9{
10  "user": {
11    "accessTokens": [
12      {
13        "appId": "your-app-id",
14        "url": "https://fl4.sandbox.yodlee.com/authenticate/restserver/",
15        "value": "FASTLINK_TOKEN_VALUE"
16      }
17    ]
18  }
19}
20
21// FastLink URL to open:
22https://fl4.sandbox.yodlee.com/authenticate/restserver/?token=FASTLINK_TOKEN_VALUE

After FastLink completes, Yodlee has linked the user's bank account(s) to their Yodlee user profile. Now you fetch this data using the API Connector with both tokens present in the request headers. Add two API calls to your Yodlee API Connector: Call: 'Get Accounts' - Method: GET - Path: /accounts - Parameters: none required (returns all accounts for the authenticated userSession user) - Both cobSession and userSession shared headers must be populated - Set 'Use as Data' so Bubble can extract JSON fields directly - Initialize call: supply real cobSession and userSession values from a test account that already has linked institutions Call: 'Get Transactions' - Method: GET - Path: /transactions - Optional parameters: fromDate (YYYY-MM-DD format), toDate, accountId - Both cobSession and userSession headers required - Initialize call with same real token values Build a Backend Workflow 'Yodlee_FetchAndStoreData' that runs after FastLink completion: 1. Call 'Get Accounts' — loop over the returned account array and create/update 'YodleeAccount' records in Bubble's database (fields: account_id, account_name, account_type, balance, currency, provider_name, linked_user) 2. Call 'Get Transactions' with fromDate set to 90 days ago — loop over returned transactions and create 'YodleeTransaction' records (fields: transaction_id, account_id, merchant_name, amount, transaction_date, category, linked_user) Store data in Bubble's database rather than fetching live from Yodlee on every page load. This prevents excessive API calls (which consume rate limit and WU), provides faster page load times, and lets you build offline-capable reports. Build a Repeating Group on your financial dashboard page that searches for YodleeAccount records where 'linked_user = Current User'. Display balance, account type, and institution name. Add a second Repeating Group for recent transactions. RapidDev's team has built dozens of fintech Bubble apps with complex token architectures like this — if you need help designing the data schema or optimizing the polling strategy, book a free scoping call at rapidevelopers.com/contact.

1// Get Accounts
2GET /accounts
3Headers:
4  cobSession: <current-cobSession-from-db>
5  userSession: <current-userSession-from-db>
6
7// Response shape (partial):
8{
9  "account": [
10    {
11      "id": 12345,
12      "accountName": "Chase Checking",
13      "accountType": "CHECKING",
14      "balance": { "amount": 2847.50, "currency": "USD" },
15      "providerName": "Chase",
16      "isAsset": true
17    }
18  ]
19}
20
21// Get Transactions
22GET /transactions?fromDate=2025-10-01&toDate=2026-01-09
23Headers:
24  cobSession: <current-cobSession-from-db>
25  userSession: <current-userSession-from-db>
26
27// Response shape (partial):
28{
29  "transaction": [
30    {
31      "id": 98765,
32      "accountId": 12345,
33      "description": { "original": "WHOLE FOODS #123" },
34      "amount": { "amount": 67.43, "currency": "USD" },
35      "transactionDate": "2026-01-07",
36      "category": "Groceries"
37    }
38  ]
39}

Both the cobSession and userSession expire in approximately 30 minutes. Without automatic refresh, your app will start returning permission errors mid-session. You also need to apply Bubble Privacy Rules to prevent sensitive financial data from leaking to unauthorized users. Token Refresh Strategy: CobSession refresh — you already built Yodlee_MintCobSession in Step 2. Ensure your scheduled recurring Backend Workflow runs every 25 minutes. In Bubble's Backend Workflows section, find the 'Recurring events' option and set Yodlee_MintCobSession to run at a 25-minute interval. This keeps a valid cobSession in your YodleeConfig record at all times. UserSession refresh — add a check at the beginning of any workflow that touches Yodlee data: - Condition: Current User's user_session_created_at < (Current date/time - 25 minutes) - If true: run Yodlee_MintUserSession as a synchronous step before proceeding with the actual API calls Bubble workflows are sequential within a single workflow, so adding the refresh check as the first step ensures the token is valid before the API call step runs. Privacy Rules — go to Data tab → Privacy → click your 'YodleeAccount' type → Add a rule: 'When Current User is: Linked User' → check View for all fields. This ensures a user can only see their own linked accounts. Apply the same rule pattern to 'YodleeTransaction' and any other Yodlee-related data types. Also add a Privacy Rule to your User type: hide the 'yodlee_password' and 'yodlee_username' fields for all roles except the backend. In Privacy settings, add a rule: 'All Users: uncheck View for yodlee_password, yodlee_username'. These fields should only ever be accessed by Backend Workflows, never displayed in the UI or exposed via Bubble's Data API. Workload Unit (WU) awareness: Yodlee is a heavy-WU integration. Each Backend Workflow run (token mint, data fetch, user registration) consumes WU. If you have hundreds of users, the 25-minute recurring cobSession refresh alone adds up. Consider storing multiple cobSession/userSession pairs if you serve many concurrent users, and monitor your WU consumption in Bubble's Logs tab during load testing.

1// Privacy Rules pattern for YodleeAccount type
2// In Data tab → Privacy → YodleeAccount:
3// Rule: "This YodleeAccount's linked_user = Current User"
4// Checked: View (all fields)
5// Purpose: Users only see their own linked account records
6
7// UserSession freshness check in any Bubble workflow:
8// Step 1: Only when: Current User's user_session_created_at < Current date/time - 25 minutes
9//         Action: Schedule API Workflow > Yodlee_MintUserSession (run now)
10// Step 2: (After Step 1) — Proceed with Yodlee API call using fresh userSession
11
12// Recurring cobSession refresh:
13// Backend Workflows → Recurring events → Yodlee_MintCobSession → every 25 minutes