BlinkPay connects to all major New Zealand banks, providing comprehensive coverage for retail and personal banking accounts.
Both products connect to the same six production banks. Blink Data can read accounts, balances, transactions and party details at every bank, but statements only at some:
| Bank | bank value | Blink Payments | Blink Data | Blink Data statements |
|---|---|---|---|---|
| ANZ New Zealand | ANZ | ✓ | ✓ | ✓ |
| ASB Bank | ASB | ✓ | ✓ | ✓ |
| Bank of New Zealand (BNZ) | BNZ | ✓ | ✓ | ✓ |
| Kiwibank | Kiwibank | ✓ | ✓ | ✗ |
| NZHL | NZHL | ✓ | ✓ | ✗ |
| Westpac New Zealand | Westpac | ✓ | ✓ | ✓ |
The bank value is case-sensitive. In the sandbox, test with PNZ, BlinkPay's test bank, which supports every flow and, for Blink Data, every data type including statements. Which banks you can use is set for your organisation: on Blink Data, a bank value the API doesn't recognise returns 400 BDT243, and a bank your organisation isn't set up for returns 400 BDT213.
Each bank supports different authentication flows and features. Understanding these differences helps you provide the best experience for your customers.
Different banks support different authentication flows. Here's what's available:
| Redirect Method | ASB | BNZ | Westpac | ANZ | Kiwibank | NZHL |
|---|---|---|---|---|---|---|
| Browser Redirect (Web) | ✓ QR code | ✓ Direct (2FA) | ✓ Direct | ✓ QR code | ✓ Direct | ✓ Direct |
| Deep Link to Bank App (Mobile) | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ |
Notes:
| Identifier Type | ASB | BNZ | Westpac | ANZ | Kiwibank | NZHL |
|---|---|---|---|---|---|---|
Mobile Number (mobile_number) | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ |
Email (email) | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ |
Access Number (banking_username) | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ |
Consent ID (consent_id, repeat customer) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
An identifier the bank doesn't recognise is not reported as an error: the consent is created and times out. ASB, BNZ and Westpac send a push notification for a decoupled request; ANZ sends a goMoney notification on iOS, and on Android the customer opens goMoney to find the request; Kiwibank customers open their app to find the request. See Decoupled Flow Identifiers for how to use each identifier.
All banks support Gateway Flow on both products, and it is recommended for most integrations.
Recommended: Gateway Flow
The Gateway Flow is recommended for most integrations as it automatically selects the best available flow for each bank and handles all authentication complexity.
Redirect Flow:
Decoupled Flow:
Payment Limits (Blink Payments only): see Payment Limits. ANZ caps each payment rather than a daily total, and requires Voice ID over $10,000.
Blink Data: accounts, balances, transactions, statements and party details.
Session Timeout:
Redirect Flow:
Decoupled Flow:
Payment Limits (Blink Payments only): see Payment Limits.
Blink Data: accounts, balances, transactions, statements and party details.
Session Timeout:
Special Features:
Redirect Flow:
Decoupled Flow:
Payment Limits (Blink Payments only): see Payment Limits.
Blink Data: accounts, balances, transactions, statements and party details. A consent's start_date_time can be no more than 2 years in the past.
Session Timeout:
2FA Requirements:
BNZ 2FA Restriction
Blink Payments: devices registered with BNZ for less than 24 hours cannot make payments. This is a BNZ security requirement. Customers must wait 24 hours after registering a new device before completing payments.
Redirect Flow:
Decoupled Flow:
Payment Limits (Blink Payments only): see Payment Limits.
Blink Data: accounts, balances, transactions and party details; statements are not available.
Session Timeout:
Redirect Flow:
Decoupled Flow:
Payment Limits (Blink Payments only): read the current limit from payment_limit on the Blink Payments metadata endpoint; see Payment Limits.
Blink Data: accounts, balances, transactions and party details; statements are not available.
Session Timeout:
Redirect Flow:
Decoupled Flow:
banking_username), or Consent IDPayment Limits (Blink Payments only): see Payment Limits.
Blink Data: accounts, balances, transactions, statements and party details.
Session Timeout:
Special Features:
The decoupled flow needs an identifier that tells the bank which customer to send the request to. The redirect flow needs none: the customer identifies themselves at the bank. Each bank accepts different identifier types:
| Bank | identifier_type values |
|---|---|
| ANZ | mobile_number, consent_id |
| ASB | mobile_number, consent_id |
| BNZ | mobile_number, email, consent_id |
| Kiwibank | mobile_number, consent_id |
| NZHL | mobile_number, consent_id |
| Westpac | banking_username (the customer's Access Number), consent_id |
Send the customer's mobile number as mobile_number (Westpac takes banking_username instead); use mobile_number, not phone_number. A type the bank doesn't accept is rejected when you create the consent, while a value the bank doesn't recognise is accepted and the consent simply times out.
Using Previous Consents
For a returning customer, send consent_id with the ID of an earlier consent your application created for that customer at the same bank. It must be Authorised or Consumed, not revoked, and the customer then enters nothing. If the bank rejects an old consent as an identifier, fall back to the customer's usual identifier.
Payment limits apply to Blink Payments only. Blink Data has no payment limits.
Blink Payments only. Each bank limits how much a customer can pay, and the limits differ between one-off PayNow payments and AutoPay (enduring consent) payments:
| Bank | PayNow (one-off) | AutoPay (enduring) |
|---|---|---|
| ANZ | $25,000 per payment, but no more than the customer's goMoney limit (default $10,000). No daily total. Voice ID needed over $10,000 | The same $25,000 and goMoney limits apply; the consent maximum can't exceed the goMoney limit. Voice ID needed if the consent maximum is over $10,000 |
| BNZ | $50,000 per day in total (shared with Internet Banking) | Same, no separate AutoPay limit |
| Westpac | $30,000 per day in total (shared with Westpac One) | Same, no separate AutoPay limit |
| ASB | $100,000 per day in total (shared with ASB Internet Banking and Mobile Banking) | $10,000 per payment, no daily limit (only limits set in the consent) |
| Kiwibank | $50,000 per day in total | Same; the daily limit covers PayNow and AutoPay together |
A daily total is the customer's own limit at that bank, so payments they have already made through the bank's other channels that day count towards it. ANZ's Voice ID requirement is ANZ's, not a BlinkPay limit.
BlinkPay also applies a limit to your account; contact support@blinkpay.co.nz to change it. Bank limits change, so where you need the current figure at runtime, read payment_limit from GET /payments/v1/meta, which returns one {total, currency} value per bank (including NZHL, which isn't in the table above), rather than hard-coding this table.
Verify Large Payments
For high-value payments, it's recommended to inform customers in advance, as some may need to increase their daily limit with their bank before authorising.
The minimum payment amount across all banks is $0.01 NZD.
The maximum payment amount, or how much a customer can pay, depends on their bank and on whether it is a PayNow or an AutoPay payment; see Transaction Limits for each bank's limit. Your account's own limit with BlinkPay also applies.
A customer's own daily limit can be lower than the bank maximum above, depending on their account type, security settings and history with the bank. Customers can typically view and adjust it through their internet banking or mobile app.
Every timer that can end a consent or a payment, on both products: the gateway cutoff, each bank's authorisation timeout for the redirect and decoupled flows, the payment and card deadlines, and the token and idempotency lifetimes. Banks change their windows, so Blink Payments integrations should read the live authorisation windows from GET /payments/v1/meta (redirect_flow.request_timeout and features.decoupled_flow.request_timeout; see Payment Metadata Fields). GET /v1/meta on Blink Data has no timeouts.
| Timer | Product | Value | When it runs out |
|---|---|---|---|
| Gateway session, before a bank is chosen | Both | 15 minutes | Consent GatewayTimeout |
| Redirect authorisation window | Both | Per bank, see below | Consent Rejected |
| Decoupled authorisation window | Both | Per bank, see below | Consent Rejected |
| Bank quick payment retrieval | Blink Payments | Retrieve as soon as the customer returns | That retrieval completes the payment |
| Single consent, bank payment | Blink Payments | 48 hours after the consent becomes Authorised | Consent Rejected |
| Single consent, card reservation | Blink Payments | 5 days without a payment | Reservation released, consent Revoked |
| Card quick payment never captured | Blink Payments | 24 hours after authorisation | Payment Rejected, hold released |
| Card refund | Blink Payments | 60 days after the payment completes | Refund refused with BP045; contact support |
| Enduring consent | Blink Payments | expiry_timestamp, if you set one | Consent Consumed |
| Data consent | Blink Data | expiration_date_time, if you set one | Consent Consumed |
Payment still Pending | Blink Payments | 6 hours | Contact support with the consent and payment IDs |
| Access token | Both | 1 hour | 401; request a new token |
| Idempotency key | Both | 24 hours | A reused key creates a new consent or payment |
The bank's authorisation window, from when the consent is created (or, in the gateway, from when they choose the bank). A consent that isn't authorised in time becomes Rejected.
| Bank | Redirect, Blink Payments | Redirect, Blink Data | Decoupled, Blink Payments | Decoupled, Blink Data |
|---|---|---|---|---|
| ANZ | 10 min | 10 min | 7 min | 7 min |
| ASB | 10 min | 10 min | 10 min | 5 min |
| BNZ | 10 min | 5 min | 4 min | 4 min |
| Westpac | 10 min | 10 min | 10 min | 10 min |
| Kiwibank | 10 min | 10 min | 5 min | 5 min |
| NZHL | 10 min | 10 min | 5 min | 5 min |
Show the customer a clear message when their session expires, and let them start again.
Blink Payments only. Once a consent is authorised, how long you have to take the payment depends on the consent type. Retrieve a bank quick payment as soon as the customer returns (see Redirect Flow); that call completes the payment. A single consent must be paid within 48 hours of authorisation, otherwise it becomes Rejected. An enduring consent remains valid until its expiry date or until it is revoked.
Blink Data: an authorised consent stays valid until its expiration_date_time passes (it then becomes Consumed) or it is revoked, by you or by the customer at their bank. A consent created without expiration_date_time has no expiry; if the bank ends it, data calls return 403 BDT415.
All banks support the following account types:
Accounts are identified using:
Account selection happens at the bank, during authorisation. Blink Payments: the customer chooses the account to pay from, and with an enduring consent can change accounts for later payments. Blink Data: the customer chooses one or more accounts to share, so GET /v1/accounts can return several.
"Deep linking" can mean two different things on mobile. The first is the bank's app opening when the customer is sent to the bank, instead of the bank's website; this needs nothing from you. The second is app-to-app return (redirect_to_app, Blink Payments only), which lets your app open directly from the bank's app once the customer has approved, instead of coming back through the browser. It needs custom setup with each bank, so request it through BlinkPay support, who can tell you more; the banks that offer it are below. See App-to-App Flow for how it works.
| Bank | Opens the Bank App on Mobile | App-to-App Return (redirect_to_app) |
|---|---|---|
| ANZ | ✓ (current goMoney app) | ✗ |
| ASB | ✓ | ✓ On request |
| BNZ | ✗ Website | ✗ |
| Kiwibank | ✗ Website | ✗ |
| NZHL | ✗ Website | ✗ |
| Westpac | ✓ | ✓ On request |
Without app-to-app return, the customer comes back to your redirect_uri, which can be a custom scheme or universal link that opens your app. For complete mobile integration guidance, including in-app browsers (embedded WebViews are not supported), registering your return link, and platform requirements:
View Mobile Integration Guide →
Business Account Support
To access a business account via open banking, it generally needs to be linked to a personal account. Current open banking standards (v2.3) are tailored for retail/personal banking, and business accounts with multi-authorisation requirements may have limitations.
Version 3 of the open banking standard will address:
What to tell a customer who is having trouble authorising at their bank:
banking_username) or Consent IDFor common bank issues (authentication failures, payment limits, session timeouts) and their solutions: