API reference / Connected account
Create a hosted connect link
Written and maintained by The ProspectAPIs team
POST/v1/accounts/connect-link
POST /v1/accounts/connect-link is the ProspectAPIs operation createAccountConnectLink, in the Connected account group of the REST API. A short-lived, single-use URL on our site where your end user connects their own account: a sign-in with any code or check it asks for, or a session string. You never handle the password. Refused while connecting accounts is unavailable. Free. Cost: free; a single-use link where your end user connects their own account, with signed account events. Send your API key as a Bearer token in the Authorization header.
How this fits with the rest of the connected account API, with worked examples, is in the connected accounts guide.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
| Idempotency-Key | header | string | Optional, 1 to 255 printable ASCII characters. A retry with the same key and body within 24 hours gets the first answer back with Idempotent-Replayed: true and is never charged again. The same key with a different body is 422; a retry while the first call is still running is 409. |
Request body
JSON (ConnectLinkRequest). Every field is optional. A create link connects a new account; a reconnect link reconnects the account it names and keeps its account_id.
| Field | Type | Description |
|---|---|---|
| type | string: create, reconnect | create connects a new account; reconnect reconnects account_id. Default "create". |
| account_id | string | For type reconnect only: the account_id from GET /v1/accounts. |
| name | string | Your own reference for the account (for example your user id). Passed back in the redirect and in every account event. At most 200 characters. |
| expires_on | string (date-time) | When the link stops working: 5 minutes to 24 hours from now. Default 1 hour. |
| success_redirect_url | string (uri) | https URL the end user's browser is sent to once connected, with status=connected, account_id and name added to the query. At most 2048 characters. |
| failure_redirect_url | string (uri) | https URL the end user is sent to when the link can no longer succeed (expired, used, too many attempts, a restricted account), with status=failed, name and reason added. At most 2048 characters. |
| notify_url | string (uri) | https URL on a public host that receives this account's events: account.connected, account.reconnect_required and account.disconnected, signed with webhook_secret. At most 2048 characters. |
{}Responses
| Status | Meaning |
|---|---|
| 201 | The link. url and webhook_secret are shown only here. |
| 400 | Invalid request: an unknown field, an expiry out of range, a redirect that is not https, a notify_url on a private host. |
| 401 | The API key is missing or invalid. |
| 404 | type reconnect: no account with that account_id on this key. |
| 409 | type create: this key already holds the most connected accounts it can (50). |
| 503 | Temporarily unavailable, or connecting accounts is not available right now. |
Every error answers with the same JSON body, an error string and sometimes a code; the errors page lists each status and when it happens.
201 response fields
The link. url and webhook_secret are shown only here. The body is a ConnectLink.
| Field | Type | Description |
|---|---|---|
| link_id required | string (uuid) | Revoke the link with DELETE /v1/accounts/connect-link/{link_id}. |
| url required | string (uri) | Send this to your end user. It is single use, works until expires_on, and is shown only in this answer: we store only a hash of its token. The token sits in the URL fragment, so it reaches no server log. |
| type required | string: create, reconnect | |
| account_id required | string or null | The account a reconnect link reconnects; null for a create link (the account_id comes back on the redirect and in account.connected). |
| name required | string or null | |
| expires_on required | string (date-time) | |
| success_redirect_url required | string or null | |
| failure_redirect_url required | string or null | |
| notify_url required | string or null | |
| webhook_secret | string | Only when notify_url was set, and only in this answer: the key the account's events are signed with. |
| Header | Meaning |
|---|---|
| RateLimit-Limit | Requests this API key may make per minute. |
| RateLimit-Remaining | Requests left in the current one-minute window. |
| RateLimit-Reset | Seconds until the current window resets. |
Code samples
Each sample sends the same request. Set PROSPECTAPIS_KEY in your environment first. Values come from the spec's examples; replace them with your own.
curl -X POST https://api.prospectapis.com/v1/accounts/connect-link \
-H "Authorization: Bearer $PROSPECTAPIS_KEY" \
-H "Content-Type: application/json" \
-d '{}'const res = await fetch("https://api.prospectapis.com/v1/accounts/connect-link", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.PROSPECTAPIS_KEY}`, "Content-Type": "application/json" },
body: JSON.stringify({}),
});
if (!res.ok) throw new Error(`${res.status}: ${(await res.json().catch(() => ({}))).error ?? res.statusText}`);
const data = await res.json();
console.log(data);import os, requests
res = requests.post(
"https://api.prospectapis.com/v1/accounts/connect-link",
headers={"Authorization": f"Bearer {os.environ['PROSPECTAPIS_KEY']}"},
json={},
timeout=30,
)
res.raise_for_status()
data = res.json()
print(data)Billing
The call itself is free, and what it sets up is billed as it runs: a single-use link where your end user connects their own account, with signed account events. Metered spend on the same key is reported after each response in X-Credits-Remaining, and GET /v1/account shows the balance at any time.
Related
The connected accounts guide covers this area end to end. Previous operation: Your post insights (live). Next operation: Revoke a hosted connect link. Every operation, grouped by area, is on the API reference index.
Create a free account to get a key, then run the samples above with your own values (this call acts for real, so use real inputs).
Was this page helpful?