How to Integrate Lovable with Yodlee

Go to developer.envestnet.com and create a developer account. After email verification, navigate to 'My Applications' and click 'Create Application'. Fill in your application name, description, and intended use case. For development access, select the 'Developer' tier which provides sandbox access with test accounts. Once your application is approved (typically within 24-48 hours), navigate to your application's detail page. You'll find three key credentials: ClientId (a UUID-format identifier), Secret (a long random string), and your Cobrand Name (a short identifier like 'restserver' in the sandbox). These three values together authenticate your application to Yodlee's API. Yodlee's authentication is a two-step process that differs from simpler API keys. First, you obtain a cobrand (app-level) token by authenticating with your ClientId, Secret, and Cobrand Name. This app-level token represents your application. Second, you obtain a user token by authenticating a specific user within your app. Each end-user of your Lovable app must have a corresponding Yodlee user record, and their token is used for all data requests related to that user's accounts. In the sandbox, Yodlee provides pre-configured test users (like 'sbMem...' format usernames) with pre-linked test financial accounts. This lets you test the entire data retrieval flow without going through the FastLink bank connection UI, which speeds up development.

Open your Lovable project, click the '+' icon in the top-right, select 'Cloud', and expand the Secrets section. Add the following credentials as encrypted environment variables. Add YODLEE_CLIENT_ID with your ClientId value. Add YODLEE_SECRET with your Secret value. Add YODLEE_COBRAND_NAME with your cobrand name ('restserver' for sandbox). Add YODLEE_API_BASE with 'https://sandbox.api.yodlee.com/ysl' for sandbox or the production URL when ready. Add YODLEE_LOCALE with 'en_US' as the default locale for your application. Yodlee's credentials grant full read access to all financial data for all users registered under your cobrand. Unlike a simple API key that just grants access to a data feed, Yodlee credentials represent a trust relationship with financial institutions and carry significant data responsibility. Protecting them with Cloud Secrets is not just good practice but a Yodlee contractual requirement — their developer agreement requires that credentials be stored securely and never exposed in client-side code. Lovable's SOC 2 Type II certified secrets infrastructure meets this requirement.

Yodlee's authentication requires two sequential token requests. The cobrand (app) token request authenticates your application using your clientId and secret. The user token request authenticates a specific end-user using the cobrand token plus the user's loginName in your Yodlee cobrand. For new users, you must first register them in Yodlee using a POST to /user/register with a loginName (can be your app's user ID), email, and locale. This creates a corresponding Yodlee user record. Subsequent sessions for the same user just need the user token request. For the FastLink widget (the bank connection UI), you need a user token but also generate a FastLink token using POST /user/accessTokens. This token is passed to the FastLink JavaScript SDK to initialize the widget. FastLink handles the entire bank login flow — you just provide the token and a callback function, and FastLink calls your callback when the user successfully adds an account. Create an Edge Function that handles all three operations as separate actions: get-cobrand-token, get-user-token, and get-fastlink-token. Cache cobrand tokens for 25 minutes (they expire at 30) and user tokens per their expiry. For complex multi-user deployments with enterprise-level usage, RapidDev's team can help design token caching architectures that scale efficiently.

1// supabase/functions/yodlee-auth/index.ts
2import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
3import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
4
5const BASE = Deno.env.get("YODLEE_API_BASE") ?? "";
6const CLIENT_ID = Deno.env.get("YODLEE_CLIENT_ID") ?? "";
7const SECRET = Deno.env.get("YODLEE_SECRET") ?? "";
8const COBRAND = Deno.env.get("YODLEE_COBRAND_NAME") ?? "";
9const corsHeaders = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "POST, OPTIONS", "Access-Control-Allow-Headers": "Content-Type, Authorization" };
10
11serve(async (req) => {
12  if (req.method === "OPTIONS") return new Response(null, { headers: corsHeaders });
13  const supabase = createClient(Deno.env.get("SUPABASE_URL") ?? "", Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "");
14  const body = await req.json();
15  const { action, login_name } = body;
16
17  try {
18    const getCobrandToken = async () => {
19      const { data: cached } = await supabase.from("yodlee_tokens").select("cobrand_token, cobrand_expires").order("cobrand_expires", { ascending: false }).limit(1).single();
20      if (cached && new Date(cached.cobrand_expires) > new Date(Date.now() + 60_000)) return cached.cobrand_token;
21
22      const res = await fetch(`${BASE}/cobrand/login`, {
23        method: "POST",
24        headers: { "Api-Version": "1.1", "Content-Type": "application/json" },
25        body: JSON.stringify({ cobrand: { cobrandLogin: COBRAND, cobrandPassword: SECRET } }),
26      });
27      const data = await res.json();
28      if (!data.session?.cobSession) throw new Error("Cobrand login failed");
29      const expires = new Date(Date.now() + 25 * 60_000).toISOString();
30      await supabase.from("yodlee_tokens").insert({ cobrand_token: data.session.cobSession, cobrand_expires: expires });
31      return data.session.cobSession;
32    };
33
34    if (action === "cobrand-token") {
35      const token = await getCobrandToken();
36      return new Response(JSON.stringify({ cobrand_token: token }), { headers: { ...corsHeaders, "Content-Type": "application/json" } });
37    }
38
39    if (action === "user-token") {
40      const cobToken = await getCobrandToken();
41      const res = await fetch(`${BASE}/user/login`, {
42        method: "POST",
43        headers: { "Api-Version": "1.1", "Cobrand-Session": cobToken, "Content-Type": "application/json" },
44        body: JSON.stringify({ user: { loginName: login_name, password: CLIENT_ID } }),
45      });
46      const data = await res.json();
47      if (!data.user?.session?.userSession) throw new Error("User login failed");
48      return new Response(JSON.stringify({ user_token: data.user.session.userSession }), { headers: { ...corsHeaders, "Content-Type": "application/json" } });
49    }
50
51    return new Response(JSON.stringify({ error: "Unknown action" }), { status: 400, headers: corsHeaders });
52  } catch (err) {
53    return new Response(JSON.stringify({ error: err.message }), { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } });
54  }
55});

With authentication working, create the data retrieval Edge Function. Yodlee's main data endpoints are: GET /accounts (all linked accounts with balances), GET /transactions (transaction history with Yodlee's 15,000-category classification), and GET /holdings (investment securities for investment accounts). All data requests require the user-session token in the Authorization header as 'Bearer {user_token}' plus the cobrand session in a separate Cobrand-Session header. The user_token is user-specific — each user's data is isolated in Yodlee by their session token. For transactions, Yodlee provides much richer categorization than Plaid — over 15,000 categories in a hierarchical taxonomy. For display purposes, use the top-level category (categoryType: EXPENSE, INCOME, TRANSFER) combined with the category name (e.g., 'Restaurants', 'Salary', 'Credit Card Payment'). Filter transactions by date range using the fromDate and toDate query parameters in YYYY-MM-DD format. Store synced data in Supabase tables (yodlee_accounts, yodlee_transactions) and apply RLS policies so users only access their own records. Use the user's Supabase Auth user_id as the foreign key for all Yodlee data, maintaining the mapping between Supabase users and their Yodlee login names in a separate user_integrations table.