Yodlee

Go to developer.yodlee.com and sign up for a free developer account. Once approved, you will receive your cobrand credentials: a cobrand login name and a cobrand password. These are your application's identity — the equivalent of an API key for your specific Yodlee integration. Keep them secure. The Sandbox environment is at https://sandbox.api.yodlee.com/ysl. It includes a set of pre-configured test financial institutions you can use to test account linking and data fetching without connecting real bank accounts. The Production environment is at https://production.api.yodlee.com/ysl — do not use it until your integration is tested and you have a Production agreement with Yodlee. Now understand the two-tier flow before writing any code: 1. Admin token: your proxy POSTs your cobrand login and password to /cobrand/login to get a short-lived admin token (cobSession). This token represents your application and lets you manage users and generate user tokens. 2. User registration: when a new user signs up for your app, the proxy calls /user/register using the admin token to create a Yodlee user record for them. This returns a userSession token for that user. 3. FastLink token: before opening FastLink, the proxy generates a FastLink token by calling the appropriate Yodlee endpoint with the userSession. The app receives only this temporary token, which is used solely to open the FastLink widget. 4. User JWT for data: after the user links accounts via FastLink, the proxy calls Yodlee's account and transaction endpoints using the user's JWT (userSession) to fetch their financial data, then stores it in Firestore or Supabase for the app to read.

Your Firebase Cloud Function (or Supabase Edge Function) is the only place that ever touches Yodlee tokens. Deploy a proxy with three main functions: CobrandLogin (gets the admin token), UserSetup (registers a new user and stores their user credentials), and GetUserSession (gets a fresh user JWT for a registered user). CobrandLogin POSTs to /cobrand/login with your cobrand credentials in the request body. Store the returned cobSession in Firestore with a timestamp. Because cobSessions expire, check the timestamp on every proxy call and refresh if needed — call CobrandLogin again and update the stored token. For UserSetup, when a user signs up for your FlutterFlow app, call your proxy's UserSetup function. The proxy uses the admin cobSession to POST to /user/register with a username and password for this user (these are Yodlee-specific credentials, not your app's auth credentials — generate them programmatically per user). Store the Yodlee username and password for this user in Firestore alongside your app's user ID so you can mint a user JWT on demand. GetUserSession takes a user ID, looks up their stored Yodlee credentials, and POSTs to /user/login to get a fresh userSession JWT. This is the token that authorises all financial data reads for that user. Store the userSession with a timestamp and refresh it when it expires — typically after 30 minutes.

1// Firebase Cloud Function proxy — index.js (key functions)
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const axios = require('axios');
5admin.initializeApp();
6
7const YODLEE_BASE = 'https://sandbox.api.yodlee.com/ysl'; // switch to production.api.yodlee.com for live
8
9// Get or refresh the cobrand admin token
10async function getCobSession() {
11  const doc = await admin.firestore().doc('yodlee/cobSession').get();
12  if (doc.exists && (Date.now() - doc.data().created_at) < 25 * 60 * 1000) {
13    return doc.data().cobSession; // reuse if less than 25 min old
14  }
15  const cfg = functions.config().yodlee;
16  const resp = await axios.post(`${YODLEE_BASE}/cobrand/login`, {
17    cobrand: { cobrandLogin: cfg.cobrand_login, cobrandPassword: cfg.cobrand_password, locale: 'en_US' },
18  });
19  const cobSession = resp.data.session.cobSession;
20  await admin.firestore().doc('yodlee/cobSession').set({ cobSession, created_at: Date.now() });
21  return cobSession;
22}
23
24// Register a new Yodlee user (call once per app user at signup)
25exports.yodleeRegisterUser = functions.https.onCall(async (data, context) => {
26  const { appUserId } = data;
27  const cobSession = await getCobSession();
28  // Generate unique Yodlee user credentials from the app user ID
29  const yodleeLogin = `user_${appUserId}@yourapp.com`;
30  const yodleePassword = `Pwd_${appUserId}_${Date.now()}`;
31  const resp = await axios.post(`${YODLEE_BASE}/user/register`,
32    { user: { loginName: yodleeLogin, password: yodleePassword, email: yodleeLogin } },
33    { headers: { cobSession } }
34  );
35  // Store the Yodlee credentials for this user — needed to mint user JWTs later
36  await admin.firestore().doc(`yodlee_users/${appUserId}`).set({
37    yodlee_login: yodleeLogin,
38    yodlee_password: yodleePassword,
39    registered_at: Date.now(),
40  });
41  return { ok: true };
42});
43
44// Get a user JWT (userSession) for a specific app user
45async function getUserSession(appUserId) {
46  const cobSession = await getCobSession();
47  const userDoc = await admin.firestore().doc(`yodlee_users/${appUserId}`).get();
48  const { yodlee_login, yodlee_password } = userDoc.data();
49  const resp = await axios.post(`${YODLEE_BASE}/user/login`,
50    { user: { loginName: yodlee_login, password: yodlee_password } },
51    { headers: { cobSession } }
52  );
53  return resp.data.user.session.userSession;
54}

FastLink is the account-linking experience — where users enter their bank credentials to add a financial institution. It runs as a Yodlee-hosted web page, not as a native Flutter widget. You open it in FlutterFlow using either the WebView widget (available in FlutterFlow's widget library) or a url_launcher Custom Action. To generate a FastLink token, your proxy calls the Yodlee FastLink token endpoint using the user's userSession JWT. The response includes a token that is valid for a limited time (typically 30 minutes) and can only be used to open FastLink — it does not grant access to financial data. The FlutterFlow app requests a FastLink token from your proxy and receives only this temporary, limited-scope token. The token is then used to construct the FastLink URL: https://fl4.sandbox.yodlee.com/authenticate/restserver/?token={fastLinkToken} (verify the current FastLink URL format in Yodlee's documentation). In FlutterFlow, add a WebView widget to an Account Linking screen. Set the URL to an App State variable that holds the FastLink URL (populated from the proxy's FastLink token response). When the user taps 'Add Account', a sequence of actions fires: (1) call the proxy to get a FastLink token, (2) store the FastLink URL in App State, (3) make the WebView visible. The user completes the bank login inside the WebView. When FastLink finishes (success or cancellation), it navigates or sends a signal — handle this by adding a navigation action after the WebView completes, or by detecting the URL change in the WebView to a completion page. After account linking completes, trigger a proxy call to fetch the newly linked accounts. The proxy uses the user JWT to GET /accounts from Yodlee and store the accounts list in Firestore for the app to read.

1// Generate a FastLink token in the proxy
2exports.yodleeFastLinkToken = functions.https.onCall(async (data, context) => {
3  const { appUserId } = data;
4  const cobSession = await getCobSession();
5  const userSession = await getUserSession(appUserId);
6  // Generate FastLink access token
7  const resp = await axios.post(
8    `${YODLEE_BASE}/user/accessTokens?appIds=10003600`, // verify current appIds value in Yodlee docs
9    {},
10    { headers: { cobSession, userSession } }
11  );
12  const fastLinkToken = resp.data.user.accessTokens[0].value;
13  // Return only the FastLink token — the app uses this to open the widget URL
14  return {
15    fastLinkUrl: `https://fl4.sandbox.yodlee.com/authenticate/restserver/?token=${fastLinkToken}`,
16  };
17});

After a user links accounts through FastLink, your proxy should fetch their financial data from Yodlee and store it in Firestore or Supabase. Storing the data in your backend has two major benefits: the app reads fast from Firestore (no Yodlee latency), and you avoid hitting Yodlee's per-user rate limits on every screen navigation. Create a proxy function called FetchAndStoreUserData that accepts a user ID, gets their user JWT, and calls several Yodlee endpoints in sequence: GET /accounts (list of linked accounts with balances and account types), GET /transactions?top=50 (most recent 50 transactions across all accounts), and optionally GET /accounts/{accountId}/balance for precise current balances. Write all of this data to Firestore in your user's document: users/{appUserId}/yodlee/accounts and users/{appUserId}/yodlee/transactions. Call FetchAndStoreUserData when FastLink signals completion, and again on a regular schedule (e.g., daily via Cloud Scheduler) to keep data fresh. Yodlee aggregates fresh data from connected institutions on its own schedule — typically once a day, or on-demand when you trigger a refresh via the Yodlee data refresh endpoint. For the app, always read from Firestore; trigger a Yodlee refresh from the proxy only when the user explicitly requests it (e.g., tapping a Refresh button), not on every screen load.

1// Fetch and store user's financial data in Firestore
2exports.yodleeFetchUserData = functions.https.onCall(async (data, context) => {
3  const { appUserId } = data;
4  const cobSession = await getCobSession();
5  const userSession = await getUserSession(appUserId);
6  const headers = { cobSession, userSession };
7
8  // Fetch linked accounts
9  const accountsResp = await axios.get(`${YODLEE_BASE}/accounts`, { headers });
10  const accounts = accountsResp.data.account || [];
11
12  // Fetch recent transactions
13  const txResp = await axios.get(`${YODLEE_BASE}/transactions?top=100`, { headers });
14  const transactions = txResp.data.transaction || [];
15
16  // Store in Firestore for the app to read (bypasses Yodlee on every screen load)
17  const userRef = admin.firestore().doc(`yodlee_data/${appUserId}`);
18  await userRef.set({
19    accounts,
20    transactions,
21    last_synced: Date.now(),
22  });
23
24  return { accountCount: accounts.length, transactionCount: transactions.length };
25});

With financial data stored in Firestore by the proxy, FlutterFlow can read it in two ways: via a Firebase Firestore collection backend query (fast, real-time), or via a proxy API Call that fetches and returns the stored data. The Firestore direct read is simpler for most apps — set up a Firebase integration in FlutterFlow's Settings & Integrations panel and use a Firestore backend query. In FlutterFlow, create a Data Type called YodleeAccount with fields: accountId (String), accountName (String), accountType (String), balance (Decimal), currency (String), institutionName (String). Create a second Data Type called YodleeTransaction with fields: transactionId (String), description (String), amount (Decimal), categoryType (String), date (String), accountId (String). Add a Screen called Dashboard. Add a ListView for accounts: set its data source to a Firestore Collection Query on the path yodlee_data/{appUserId} → accounts field. Map the fields to YodleeAccount. Inside each account card, show the institution name, account type, and balance. Add a separate ListView for recent transactions similarly bound. For the Add Account flow, add a Button that triggers: (1) a Backend/API Call to your proxy's yodleeFastLinkToken function, (2) updates an App State variable with the returned fastLinkUrl, (3) navigates to the Account Linking screen where the WebView is pre-configured to load the App State URL. After the WebView completes, trigger a call to yodleeFetchUserData to refresh Firestore with the new account data. RapidDev's team builds FlutterFlow fintech integrations like this end-to-end — if you'd like to skip the setup complexity, book a free scoping call at rapidevelopers.com/contact.

When your integration is tested and you are ready for real bank connections, you need a Production agreement with Yodlee/Envestnet — this is a commercial arrangement, not a self-serve toggle. Contact Yodlee to begin the Production onboarding process. Once you have Production cobrand credentials, update Firebase Functions config (firebase functions:config:set yodlee.cobrand_login='PROD_LOGIN' yodlee.cobrand_password='PROD_PASSWORD'), change the YODLEE_BASE constant from sandbox.api.yodlee.com/ysl to production.api.yodlee.com/ysl, and change the FastLink URL to the Production FastLink host. Redeploy functions. For token expiry management: both the cobSession and userSession are short-lived (approximately 30 minutes for userSession, check cobSession lifetime in Yodlee docs — verify current durations). Your proxy functions should check the stored token's age before using it. The getCobSession() helper in Step 2 already does this for the cobSession — add equivalent logic for userSession: cache it per user with a timestamp and refresh when it is older than 25 minutes. For users who have not opened the app in a long time, the stored userSession will be stale. When the proxy detects a stale userSession, it calls /user/login again with the stored Yodlee credentials to get a fresh one. This is transparent to the user — they never see a login prompt because the Yodlee credentials are stored server-side, not user-facing. Finally, add a Refresh Data button to the Dashboard that calls yodleeFetchUserData. This triggers a fresh data pull from Yodlee through the proxy and updates Firestore. Yodlee's data is typically refreshed from institutions once per day — calling Refresh triggers an immediate refresh request to Yodlee, which may take a few minutes to propagate through their aggregation pipeline.