Plaid

This connector wraps the Plaid REST API.

Environments: Plaid has two, each with its own secret and its own Items:

• Sandbox (https://sandbox.plaid.com): test institutions and test data, free. This connector calls Sandbox by default.
• Production (https://production.plaid.com): real banks. New teams (US and Canada, created since 15 April 2026) can use it for free on a Trial plan; older teams may still have Limited Production, which also runs on production.plaid.com with the Production secret, with capped free calls. Full Production access is requested in the Dashboard.

The former Development environment no longer exists: development.plaid.com does not answer and there is no Development secret any more.

Setup:

1. Sign up at https://dashboard.plaid.com and open Developers → Keys (https://dashboard.plaid.com/developers/keys). Copy your client_id and the secret of the environment you want.
2. Set PLAID_CLIENT_ID and PLAID_SECRET.
3. For real bank data, change the connector's base URL to https://production.plaid.com and use the Production secret. The secret must match the host: a Sandbox secret sent to Production (or the reverse) fails with INVALID_API_KEYS. Items and access tokens cannot be moved between environments, so link the bank again after switching.

Authentication: every POST sends client_id and secret in the JSON body, NOT as headers. The adapter merges them automatically via envVars.

Link flow: Plaid is server plus client. To obtain an access_token, your frontend uses Plaid Link with a link_token you minted server-side. This adapter assumes you already have an access_token for an Item (one connected bank). For Link itself use plaid_link_token_create.

Identifiers:

• link_token: short-lived (~30 min), passed to Link.
• public_token: returned by Link, exchanged once for an access_token.
• access_token: long-lived, scoped to one Item (institution+user).
• item_id: stable ID for an access_token's Item.

Rate limits: vary by environment + product. Sandbox is loose; production limits depend on plan. 429 with Retry-After.

Out of scope here: webhooks setup, Plaid Signal (risk scores), Income/Employment products' end-user flows, Transfer (ACH origination).