Financial account authentication
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for account authentication. A method includes receiving a user request to include financial data describing a financial account in an interface, the financial account being associated with a financial institution. The method further includes redirecting the user to a first webpage associated with the financial institution, where the user inputs into the first webpage login credentials for accessing the financial account. The method further includes, in response to the user inputting into the first webpage login credentials for accessing the financial account, receiving, from the financial institution, an access token other than the login credentials for accessing the financial account. The method further includes storing the access token for use in accessing and aggregating financial data describing the financial account.
1. A computer-implemented method, comprising:
maintaining, by an aggregation server system, a respective consumer key corresponding to each of a plurality of account providers, each consumer key being configured to identify the aggregation server system to the corresponding account provider;
receiving, at the aggregation server system, a user request to include account data describing a user account at a first account provider, in an interface, the user account being associated with a user;
redirecting, by the aggregation server system, the user to a first webpage associated with the first account provider, wherein the user inputs, into the first webpage, login credentials for accessing the user account;
in response to the user inputting into the first webpage the login credentials for accessing the user account, receiving, by the aggregation server system and from the first account provider, an access token other than the login credentials for accessing the user account, the access token identifying the user;
transmitting, from the aggregation server system and to the first account provider, a request to access the user account, wherein the request comprises (i) the access token and (ii) the consumer key corresponding to the first account provider; and
receiving, by the aggregation server system and from the first account provider in response to the request, the account data describing the user account.
2. The method of claim 1 , wherein transmitting the request to access the user account comprises providing the access token and the consumer key corresponding to the first account provider to a second webpage associated with the first account provider.
3. The method of claim 2 , wherein the access token is configured to permit obtaining account data for a specified time period.
4. The method of claim 3 , further comprising:
determining that the specified time period has elapsed;
in response to determining that the specified time period has elapsed, redirecting the user to the first webpage, wherein the user inputs, into the first webpage, the login credentials for accessing the user account;
in response to the user inputting into the first webpage the login credentials for accessing the user account, receiving, by the aggregation server system and from the first account provider, a second access token for accessing the user account; and
storing the second access token for use in aggregating the account data describing the user account.
5. The method of claim 1 , wherein, for each consumer key corresponding to a particular account provider, the consumer key is used in accessing accounts of the particular account provider and cannot be used in accessing accounts of a different account providers of the plurality of account providers.
6. The method of claim 5 , further comprising transmitting, from the aggregation server system and to the first account provider, a request to access another user account, wherein the request comprises another access token and the consumer key corresponding to the first account provider.
7. The method of claim 1 , wherein the access token is invalidated when the user changes the login credentials for accessing the user account.
8. The method of claim 1 , wherein the access token is invalidated when the login credentials for accessing the user account expire.
9. The method of claim 1 , wherein the access token is configured to limit a level of access within the user account.
10. The method of claim 1 , wherein the access token is configured to restrict types of data that are accessible using the access token.
11. A non-transient computer storage medium encoded with a computer program, the program comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:
maintaining, by an aggregation server system, a respective consumer key corresponding to each of a plurality of account providers, each consumer key being configured to identify the aggregation server system to the corresponding account provider;
receiving, at the aggregation server system, a user request to include account data describing a user account at a first account provider, in an interface, the user account being associated with a user;
redirecting, by the aggregation server system, the user to a first webpage associated with the first account provider, wherein the user inputs, into the first webpage, login credentials for accessing the user account;
in response to the user inputting into the first webpage the login credentials for accessing the user account, receiving, by the aggregation server system and from the first account provider, an access token other than the login credentials for accessing the user account, the access token identifying the user;
transmitting, from the aggregation server system and to the first account provider, a request to access the user account, wherein the request comprises (i) the access token and (ii) the consumer key corresponding to the first account provider; and
receiving, by the aggregation server system and from the first account provider in response to the request, the account data describing the user account.
12. The non-transient computer storage medium of claim 11 , wherein the instruction that causes transmitting the request to access the user account comprises an instruction that causes providing the access token and the consumer key corresponding to the first account provider to a second webpage associated with the first account provider.
13. The non-transient computer storage medium of claim 12 , wherein the access token is configured to permit obtaining account data for a specified time period.
14. The non-transient computer storage medium of claim 13 , further comprising instructions that cause:
determining that the specified time period has elapsed;
in response to determining that the specified time period has elapsed, redirecting the user to the first webpage, wherein the user inputs, into the first webpage, the login credentials for accessing the user account;
in response to the user inputting into the first webpage the login credentials for accessing the user account, receiving, by the aggregation server system and from the first account provider, a second access token for accessing the user account; and
storing the second access token for use in aggregating the account data describing the user account.
15. The non-transient computer-readable medium of claim 11 , wherein, for each consumer key corresponding to a particular account provider, the consumer key is used in accessing accounts of the particular account provider and cannot be used in accessing accounts of a different account providers of the plurality of account providers.
16. The non-transient computer-readable medium of claim 15 , further comprising an instruction that causes transmitting, from the aggregation server system and to the first account provider, a request to access another user account, wherein the request comprises another access token and the consumer key corresponding to the first account provider.
17. A system comprising one or more computers programmed to perform operations comprising:
maintaining, by an aggregation server system, a respective consumer key corresponding to each of a plurality of account providers, each consumer key being configured to identify the aggregation server system to the corresponding account provider;
receiving, at the aggregation server system, a user request to include account data describing a user account at a first account provider, in an interface, the user account being associated with a user;
redirecting, by the aggregation server system, the user to a first webpage associated with the first account provider, wherein the user inputs, into the first webpage, login credentials for accessing the user account;
in response to the user inputting into the first webpage the login credentials for accessing the user account, receiving, by the aggregation server system and from the first account provider, an access token other than the login credentials for accessing the user account, the access token identifying the user;
transmitting, from the aggregation server system and to the first account provider, a request to access the user account, wherein the request comprises (i) the access token and (ii) the consumer key corresponding to the first account provider; and
receiving, by the aggregation server system and from the first account provider in response to the request, the account data describing the user account.
18. The system of claim 17 , wherein, for each consumer key corresponding to a particular account provider, the consumer key is used in accessing accounts of the particular account provider and cannot be used in accessing accounts of a different account providers of the plurality of account providers.
19. The system of claim 18 , the operations further comprising transmitting, from the aggregation server system and to the first account provider, a request to access another user account, wherein the request comprises another access token and the consumer key corresponding to the first account provider.
20. The system of claim 17 , wherein the access token is invalidated when the user changes the login credentials for accessing the user account.