Using an AI coding assistant? Connect it to the BlinkPay MCP server, which has all of this documentation and the API schemas.
Get started with Blink Data in minutes:
# Authenticate
curl -X POST https://sandbox.data.blinkpay.co.nz/oauth2/token \
-d "client_id=YOUR_ID&client_secret=YOUR_SECRET&grant_type=client_credentials"
# Create consent
curl -X POST https://sandbox.data.blinkpay.co.nz/v1/consents \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"flow": {
"detail": {
"type": "gateway",
"redirect_uri": "https://yourapp.com/callback"
}
},
"permissions": ["ReadAccounts", "ReadBalances", "ReadTransactions"],
"expiration_date_time": "2026-12-31T23:59:59+13:00"
}'
The Blink Data base URL for each environment, with its token endpoint. API paths sit under /v1; the token endpoint sits at the host root.
| Environment | Base URL | Token endpoint |
|---|---|---|
| Sandbox | https://sandbox.data.blinkpay.co.nz | POST https://sandbox.data.blinkpay.co.nz/oauth2/token |
| Production | https://data.blinkpay.co.nz | POST https://data.blinkpay.co.nz/oauth2/token |
In the sandbox, use the test bank PNZ; the production banks (ANZ, ASB, BNZ, Westpac, Kiwibank and NZHL) are used in production. See Sandbox and Production Banks.
Let BlinkPay handle the bank selection and authentication UI. Customer selects their bank and authentication method through our hosted gateway.
Learn more about Gateway Flow →
Direct browser-based flow where customers authenticate with their bank and return to your site.
Learn more about Redirect Flow →
Customer authorises on a different device or at a different time via their banking app.
Learn more about Decoupled Flow →
All Data APIs are documented in the comprehensive Data Retrieval guide:
Explore Data Retrieval Guide →
Aggregate accounts from multiple banks into a single view.
Verify income and assess creditworthiness using actual bank data.
Automate bank reconciliation and transaction categorisation.
Track spending patterns and provide insights.
Provide holistic financial overview across institutions.
Prerequisites
Before you go live, read Credential and Integration Security for how to store credentials and handle outcomes safely, and, if you use the redirect or decoupled flow directly rather than the Gateway, Consent Experience for Direct Flows for what your consent screens must show.