Revolut Business

This connector reads your Revolut Business account through the official Business API: accounts and balances, bank details, transactions, counterparties, expenses and exchange rates. It is read-only: it cannot send payments, move money or change anything in your account.

What you need: a Revolut Business account on the Grow plan or higher (Revolut includes the Business API from Grow upwards), and a Revolut user with permission to manage the API. Personal Revolut accounts are not supported: Revolut offers no API for them apart from PSD2 open banking, which is only open to licensed providers.

How authentication works: Revolut does not issue a client secret. You create a key pair, upload the public certificate to Revolut, and AnythingMCP signs a short-lived token (a JWT, RS256, 5 minutes) with the private key whenever it needs an access token. Access tokens last 40 minutes and are renewed automatically; you authorize once.

Setup (about 10 minutes):

1. On your computer, create the key pair (macOS/Linux terminal, or WSL on Windows): openssl genrsa -out privatecert.pem 2048 openssl req -new -x509 -key privatecert.pem -out publiccert.cer -days 1825 Answer at least one of the certificate questions (for example the country); the others can stay empty.
2. In Revolut Business, open Settings → APIs → Business API and click Add API certificate. Paste the whole content of publiccert.cer (including the BEGIN/END lines) into X509 public key.
3. As OAuth redirect URI enter https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP URL>/api/mcp-oauth/callback if you host AnythingMCP yourself. Save, then copy the Client ID Revolut shows.
4. Fill in the variables and install:
   • REVOLUT_CLIENT_ID: the Client ID from step 3.
   • REVOLUT_PRIVATE_KEY: the whole content of privatecert.pem, including the BEGIN/END lines. Pasting it into the single-line field is fine. It is stored encrypted and never shown again.
   • REVOLUT_REDIRECT_DOMAIN: the domain of the redirect URI from step 3, without https:// and without a path, for example cloud.anythingmcp.com. Revolut checks that the token was issued by that domain.
5. Open the connector and click Authorize with Provider. Revolut asks you to confirm access (with two-factor authentication) and sends you back to the connector page.

Read-only by design: the connector asks Revolut for the READ scope only, so even the access token cannot initiate payments. Keep your private key safe anyway: anyone who has it and the Client ID can request tokens for your account. To revoke access, delete the certificate in Revolut's Business API settings.

Sandbox: to test with fake data, create a free account at https://sandbox-business.revolut.com, upload the certificate there instead, and in the connector's settings change the base URL to https://sandbox-b2b.revolut.com/api/1.0, the authorization URL to https://sandbox-business.revolut.com/app-confirm and the token URL to https://sandbox-b2b.revolut.com/api/1.0/auth/token. Then authorize again. Expenses are not available in the sandbox.

IP allow-list: if you set a production IP allow-list on the certificate, it must include the address AnythingMCP calls from (on AnythingMCP Cloud, ask support for the current egress IP).

Paging: transactions come newest first, up to 1000 per call. For the next page, call again with to set to the created_at of the last transaction you received. Counterparties page with created_before, expenses with to.

Troubleshooting: "invalid_request … The Token has expired" or "invalid client" after authorizing usually means REVOLUT_REDIRECT_DOMAIN does not match the redirect URI's domain, or the private key does not belong to the uploaded certificate. A redirect back with an error about the redirect URI means the URI in Revolut does not exactly match the one in step 3.