Skip to content
ProspectAPIs

API reference / Connected account

Create a hosted connect link

Written and maintained by The ProspectAPIs team

POST/v1/accounts/connect-link

POST /v1/accounts/connect-link is the ProspectAPIs operation createAccountConnectLink, in the Connected account group of the REST API. A short-lived, single-use URL on our site where your end user connects their own account: a sign-in with any code or check it asks for, or a session string. You never handle the password. Refused while connecting accounts is unavailable. Free. Cost: free; a single-use link where your end user connects their own account, with signed account events. Send your API key as a Bearer token in the Authorization header.

How this fits with the rest of the connected account API, with worked examples, is in the connected accounts guide.

Parameters

Parameters of POST /v1/accounts/connect-link
NameInTypeDescription
Idempotency-KeyheaderstringOptional, 1 to 255 printable ASCII characters. A retry with the same key and body within 24 hours gets the first answer back with Idempotent-Replayed: true and is never charged again. The same key with a different body is 422; a retry while the first call is still running is 409.

Request body

JSON (ConnectLinkRequest). Every field is optional. A create link connects a new account; a reconnect link reconnects the account it names and keeps its account_id.

Request body of POST /v1/accounts/connect-link
FieldTypeDescription
typestring: create, reconnectcreate connects a new account; reconnect reconnects account_id. Default "create".
account_idstringFor type reconnect only: the account_id from GET /v1/accounts.
namestringYour own reference for the account (for example your user id). Passed back in the redirect and in every account event. At most 200 characters.
expires_onstring (date-time)When the link stops working: 5 minutes to 24 hours from now. Default 1 hour.
success_redirect_urlstring (uri)https URL the end user's browser is sent to once connected, with status=connected, account_id and name added to the query. At most 2048 characters.
failure_redirect_urlstring (uri)https URL the end user is sent to when the link can no longer succeed (expired, used, too many attempts, a restricted account), with status=failed, name and reason added. At most 2048 characters.
notify_urlstring (uri)https URL on a public host that receives this account's events: account.connected, account.reconnect_required and account.disconnected, signed with webhook_secret. At most 2048 characters.
Example body
{}

Responses

Response codes of POST /v1/accounts/connect-link
StatusMeaning
201The link. url and webhook_secret are shown only here.
400Invalid request: an unknown field, an expiry out of range, a redirect that is not https, a notify_url on a private host.
401The API key is missing or invalid.
404type reconnect: no account with that account_id on this key.
409type create: this key already holds the most connected accounts it can (50).
503Temporarily unavailable, or connecting accounts is not available right now.

Every error answers with the same JSON body, an error string and sometimes a code; the errors page lists each status and when it happens.

201 response fields

The link. url and webhook_secret are shown only here. The body is a ConnectLink.

Fields of the 201 response
FieldTypeDescription
link_id requiredstring (uuid)Revoke the link with DELETE /v1/accounts/connect-link/{link_id}.
url requiredstring (uri)Send this to your end user. It is single use, works until expires_on, and is shown only in this answer: we store only a hash of its token. The token sits in the URL fragment, so it reaches no server log.
type requiredstring: create, reconnect
account_id requiredstring or nullThe account a reconnect link reconnects; null for a create link (the account_id comes back on the redirect and in account.connected).
name requiredstring or null
expires_on requiredstring (date-time)
success_redirect_url requiredstring or null
failure_redirect_url requiredstring or null
notify_url requiredstring or null
webhook_secretstringOnly when notify_url was set, and only in this answer: the key the account's events are signed with.
Response headers
HeaderMeaning
RateLimit-LimitRequests this API key may make per minute.
RateLimit-RemainingRequests left in the current one-minute window.
RateLimit-ResetSeconds until the current window resets.

Code samples

Each sample sends the same request. Set PROSPECTAPIS_KEY in your environment first. Values come from the spec's examples; replace them with your own.

curl
curl -X POST https://api.prospectapis.com/v1/accounts/connect-link \
  -H "Authorization: Bearer $PROSPECTAPIS_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
JavaScript (fetch)
const res = await fetch("https://api.prospectapis.com/v1/accounts/connect-link", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.PROSPECTAPIS_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({}),
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json().catch(() => ({}))).error ?? res.statusText}`);
const data = await res.json();
console.log(data);
Python (requests)
import os, requests

res = requests.post(
    "https://api.prospectapis.com/v1/accounts/connect-link",
    headers={"Authorization": f"Bearer {os.environ['PROSPECTAPIS_KEY']}"},
    json={},
    timeout=30,
)
res.raise_for_status()
data = res.json()
print(data)

Billing

The call itself is free, and what it sets up is billed as it runs: a single-use link where your end user connects their own account, with signed account events. Metered spend on the same key is reported after each response in X-Credits-Remaining, and GET /v1/account shows the balance at any time.

The connected accounts guide covers this area end to end. Previous operation: Your post insights (live). Next operation: Revoke a hosted connect link. Every operation, grouped by area, is on the API reference index.

Create a free account to get a key, then run the samples above with your own values (this call acts for real, so use real inputs).

Was this page helpful?