Plaid

Go to dashboard.plaid.com and sign up for a free Plaid account. You'll start in the Sandbox environment automatically — no application or approval is needed. Navigate to Team Settings → Keys. You'll see three sets of credentials corresponding to Sandbox, Development, and Production environments, each with a client_id and a secret. For now, copy your Sandbox client_id and your Sandbox secret. Store them somewhere secure (you'll add them to Firebase Functions config or Supabase secrets). Note that each environment uses a different base URL: Sandbox uses https://sandbox.plaid.com, Development uses https://development.plaid.com, and Production uses https://production.plaid.com. Using credentials from one environment against the wrong host returns a 400 or authentication error — this is one of the most common setup mistakes. In the Plaid Dashboard, you can also enable specific products (Transactions, Auth, Identity, Income) and configure which institutions to show in Plaid Link (sandbox supports a set of test institutions including 'First Platypus Bank'). You do not need to configure FlutterFlow yet — all credentials stay on the server.

Your proxy needs to handle at least three endpoints. Endpoint 1 — POST /create-link-token: receives the current user's ID from FlutterFlow, calls POST https://sandbox.plaid.com/link/token/create with your client_id, secret, a user object containing client_user_id (your internal user ID), client_name (your app name), products (e.g. ['transactions', 'auth']), country_codes (['US']), and language ('en'). Returns the link_token string to the app — this token is short-lived (30 minutes). Endpoint 2 — POST /exchange-public-token: receives the public_token returned by Plaid Link after the user connects their bank. Calls POST https://sandbox.plaid.com/item/public_token/exchange with client_id, secret, and public_token. Receives the permanent access_token and item_id. Stores the access_token in Firestore (collection 'plaid_items', document keyed by user ID) or Supabase (plaid_items table) — never return it to the app. Returns { success: true } to the app. Endpoint 3 — POST /get-balances (or /get-transactions): receives the user's ID, looks up their access_token from Firestore/Supabase, calls POST https://sandbox.plaid.com/accounts/balance/get with client_id, secret, and access_token, and returns the formatted balances to the app. All three endpoints read the client_id and secret from environment config — not from request parameters.

1// Firebase Cloud Function: Plaid proxy (Node.js)
2const functions = require('firebase-functions');
3const axios = require('axios');
4const admin = require('firebase-admin');
5const cors = require('cors')({ origin: true });
6const express = require('express');
7const app = express();
8app.use(cors);
9app.use(express.json());
10admin.initializeApp();
11
12const PLAID_BASE = 'https://sandbox.plaid.com'; // switch env as needed
13const PLAID_CLIENT_ID = () => functions.config().plaid.client_id;
14const PLAID_SECRET = () => functions.config().plaid.secret;
15
16// 1. Create link token
17app.post('/create-link-token', async (req, res) => {
18  const { user_id } = req.body;
19  const response = await axios.post(`${PLAID_BASE}/link/token/create`, {
20    client_id: PLAID_CLIENT_ID(),
21    secret: PLAID_SECRET(),
22    user: { client_user_id: user_id },
23    client_name: 'My Finance App',
24    products: ['transactions'],
25    country_codes: ['US'],
26    language: 'en',
27  });
28  res.json({ link_token: response.data.link_token });
29});
30
31// 2. Exchange public token
32app.post('/exchange-public-token', async (req, res) => {
33  const { public_token, user_id } = req.body;
34  const response = await axios.post(`${PLAID_BASE}/item/public_token/exchange`, {
35    client_id: PLAID_CLIENT_ID(),
36    secret: PLAID_SECRET(),
37    public_token,
38  });
39  await admin.firestore().collection('plaid_items').doc(user_id).set({
40    access_token: response.data.access_token,
41    item_id: response.data.item_id,
42    updated_at: new Date(),
43  });
44  res.json({ success: true });
45});
46
47// 3. Get balances
48app.post('/get-balances', async (req, res) => {
49  const { user_id } = req.body;
50  const doc = await admin.firestore().collection('plaid_items').doc(user_id).get();
51  const { access_token } = doc.data();
52  const response = await axios.post(`${PLAID_BASE}/accounts/balance/get`, {
53    client_id: PLAID_CLIENT_ID(),
54    secret: PLAID_SECRET(),
55    access_token,
56  });
57  res.json({ accounts: response.data.accounts });
58});
59
60exports.plaid = functions.https.onRequest(app);

In FlutterFlow, go to Custom Code in the left navigation panel → + Add → Action. Name this action OpenPlaidLink. Before writing Dart, click into the Dependencies field, type plaid_flutter, and add the package (check pub.dev for the current stable version, e.g. ^4.0.0). FlutterFlow adds this to the Flutter project's pubspec.yaml automatically. Now write the Custom Action. It will: (1) call your proxy's /create-link-token endpoint with the current user's ID to get a link_token; (2) open Plaid Link using the PlaidLink.open() method from the SDK with the link_token; (3) in the onSuccess callback, call your proxy's /exchange-public-token endpoint with the received public_token and the user's ID; (4) on success, update an App State boolean (bankLinked: true) and navigate the user to the account dashboard. Add a kIsWeb guard at the very top of the action so a web build doesn't crash attempting to call native APIs. Add two parameters to the action: proxyBaseUrl (String) and userId (String). In the Action Flow Editor on the 'Link Bank Account' button, add this Custom Action and wire proxyBaseUrl to your App Value (proxy URL) and userId to the current authenticated user ID.

1// Custom Action: OpenPlaidLink (plaid_flutter ^4.0.0)
2import 'package:flutter/foundation.dart' show kIsWeb;
3import 'package:plaid_flutter/plaid_flutter.dart';
4import 'package:http/http.dart' as http;
5import 'dart:convert';
6
7Future<bool> openPlaidLink(
8  String proxyBaseUrl,
9  String userId,
10) async {
11  if (kIsWeb) {
12    // Plaid Link is not supported on web
13    return false;
14  }
15
16  // Step 1: Get link token from backend
17  final tokenResponse = await http.post(
18    Uri.parse('$proxyBaseUrl/create-link-token'),
19    headers: {'Content-Type': 'application/json'},
20    body: jsonEncode({'user_id': userId}),
21  );
22  final linkToken = jsonDecode(tokenResponse.body)['link_token'] as String;
23
24  // Step 2: Open Plaid Link
25  bool success = false;
26  final config = LinkTokenConfiguration(token: linkToken);
27  PlaidLink.open(configuration: config);
28
29  PlaidLink.onSuccess.listen((LinkSuccess event) async {
30    final publicToken = event.publicToken;
31    // Step 3: Exchange public token server-side
32    await http.post(
33      Uri.parse('$proxyBaseUrl/exchange-public-token'),
34      headers: {'Content-Type': 'application/json'},
35      body: jsonEncode({'public_token': publicToken, 'user_id': userId}),
36    );
37    success = true;
38  });
39
40  return success;
41}

Once a user has linked their bank account (bankLinked App State = true), the app can display their financial data. In FlutterFlow, create API Calls in the left nav → API Calls panel that hit your proxy's /get-balances and /get-transactions endpoints. For GetBalances: Method POST, add a Body variable userId (String), parse the response using JSON Paths — the accounts array response includes account name, current balance, available balance, and account type. Create a FlutterFlow Data Type called PlaidAccount with fields: name (String), current_balance (Double), available_balance (Double), account_type (String). Use the API Call in a Backend Query on a ListView widget, binding each list item to a PlaidAccount. For GetTransactions: similarly, create a PlaidTransaction Data Type with fields: name (String), amount (Double), date (String), category (String). Bind a second ListView to the transactions data. On the Account Overview page, trigger both API Calls in the Page Load action (Action Flow Editor → On Page Load → Add API Call actions). Show loading indicators with a conditional visibility widget bound to an App State boolean (isLoadingData) that you set to true before the calls and false after. Format currency values using FlutterFlow's built-in number formatter or a formula: '$' + balance.toStringAsFixed(2).

1// Sample API responses for FlutterFlow Response & Test tab:
2
3// GetBalances response:
4{
5  "accounts": [
6    {
7      "account_id": "acc_abc123",
8      "name": "Checking Account",
9      "type": "depository",
10      "subtype": "checking",
11      "balances": {
12        "current": 2345.67,
13        "available": 2100.00
14      }
15    }
16  ]
17}
18
19// JSON Paths to bind in FlutterFlow:
20// Account name:      $.accounts[0].name
21// Current balance:   $.accounts[0].balances.current
22// Available balance: $.accounts[0].balances.available

Plaid's sandbox provides test institutions and credentials you can use without connecting real bank accounts. In the Plaid Link UI (on your physical device), search for 'First Platypus Bank' — it's a test institution always available in sandbox. Use the credentials user_good / pass_good to complete the Link flow successfully. The sandbox returns realistic fake account and transaction data. Test the error paths too: use user_error / pass_error to simulate a failed authentication. Verify in your Firestore that the access_token is stored after a successful link, and that GetBalances returns data. For transactions, use /transactions/sync rather than /transactions/get for new integrations — sync is Plaid's recommended API and handles incremental updates. When you're ready to move beyond sandbox: Plaid's Development environment allows up to 100 real bank connections for testing with actual institutions (requires business information). Production requires Plaid approval, a privacy policy, and agreement to Plaid's terms — apply from the Plaid Dashboard under your team's settings. Change the proxy's base URL environment variable from sandbox.plaid.com to production.plaid.com and update the secret to the Production secret. Do not keep sandbox secrets in a production deployment.

1// Plaid sandbox test credentials:
2// Institution: First Platypus Bank
3// Username: user_good
4// Password: pass_good
5// MFA code (if prompted): 1234
6
7// Sandbox base URL: https://sandbox.plaid.com
8// Development base URL: https://development.plaid.com
9// Production base URL: https://production.plaid.com
10
11// Switch in your Firebase config:
12// firebase functions:config:set plaid.env="production" plaid.secret="production_secret_here"