Desco FCU Mobile API integration (OpenBanking / Section 1033)

Authentication & session bridging

We mirror the in-app login flow (username/password plus Touch ID / Face ID device binding) into a clean OAuth-style token service. Tokens are scoped per data class, refreshed on a sliding window, and revocable on demand — so a downstream PFM dashboard can pull balances without ever holding raw member credentials.

Balance & account inventory API

Endpoint GET /accounts returns the same hierarchy a member sees in the app: checking, savings, money market, mortgage, auto loan and other consumer-loan tradelines, each with current balance, available balance, APR, and next-payment fields. Useful for net-worth dashboards and member-onboarding flows that need a snapshot in seconds.

Transaction & statement export

Paginated history with date-range, account, and merchant filters. Output formats: JSON (FDX-shaped), CSV for spreadsheet ingestion, and the original statement PDF. Use it for reconciliation, expense categorization, or feeding a transaction-clustering model.

Transfers, bill pay & ACH

Programmatic internal transfers, external ACH transfers to other US institutions (NACHA-compliant batches), and bill-pay schedule management. Each call returns an immutable request_id and a webhook is fired on state changes (pending → posted → returned).

Mobile check deposit (RDC)

Capture endpoint accepts front/back JPEG payloads plus amount, runs MICR validation, and returns a deposit reference and provisional credit timing. A second webhook signals final clearance — closing the loop for finance teams that need authoritative posting confirmations.

Alerts & profile preferences

Read and write a member's notification preferences (low-balance, large transaction, deposit posted) and profile data (contact info, statement-delivery method). Lets a third-party app surface alerts inside its own UI without a duplicate notification stack.

1 · Personal-finance dashboard for Desco members

A regional fintech rolling out a budgeting app to its existing customers needs a live view of every external bank and credit union the user holds. After member consent, our API returns Desco FCU balances and transactions in FDX-shaped JSON; the dashboard merges them with Plaid feeds from megabanks. Field map: account.balanceCurrent → fdx.currentBalance, txn.postedDate → fdx.postedTimestamp.

2 · Small-business accounting reconciliation

Local SMBs in Portsmouth, Ashland, and Huntington run QuickBooks / Xero. We ship a worker that polls /transactions?account=BUSINESS_CHK&since=… nightly, pushes posted entries into the accounting ledger, and flags ACH returns. This eliminates manual CSV downloads and is the single most-requested OpenBanking workflow for credit unions.

3 · Mortgage / loan origination data pull

A mortgage broker comparing offers needs verifiable income and asset evidence. With member consent we pull 12–24 months of statements (PDF) plus a JSON balance-history series, package it as a Verification of Assets (VOA) bundle, and sign it for the underwriter — a workflow that mirrors how Finicity's Mortgage Verification Service works for larger institutions.

4 · Treasury automation & sweep

A non-profit with several Desco FCU accounts wants nightly sweeps into a primary operating account. We expose POST /transfers with idempotency keys; combined with the balance webhook, it runs an unattended rule (if savings > threshold, sweep to checking) and writes an immutable audit log per move.

5 · Embedded mobile-deposit for vertical SaaS

A property-management SaaS lets landlords accept rent checks. By embedding our RDC endpoint behind a member-consent gate, the SaaS becomes a thin client over the credit-union deposit pipeline — no separate banking license required, and posting confirmations flow back as webhooks the moment Desco FCU clears the item.

1. OAuth-style login & token refresh

POST /api/v1/desco/auth/login
Content-Type: application/json

{
  "member_number": "********",
  "password": "********",
  "device_id": "ios-uuid-or-android-aaid",
  "biometric_token": "<optional, from Touch ID / Face ID>"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_...",
  "expires_in": 1800,
  "scopes": ["accounts:read","txn:read","transfers:write","rdc:write"]
}

2. Statement query with paging & FDX mapping

GET /api/v1/desco/transactions
?account_id=acc_chk_001
&from=2026-01-01&to=2026-04-30
&page_size=100&cursor=opaque-cursor
Authorization: Bearer <ACCESS_TOKEN>

200 OK
{
  "items": [
    {
      "id": "txn_9f3b…",
      "postedDate": "2026-04-28",
      "amount": -42.17,
      "currency": "USD",
      "description": "KROGER #421 PORTSMOUTH OH",
      "category": "groceries",
      "runningBalance": 1284.06
    }
  ],
  "next_cursor": "…",
  "has_more": true
}

3. Mobile deposit + state webhook

POST /api/v1/desco/rdc
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: multipart/form-data

front=<jpeg>  back=<jpeg>  amount=250.00  account_id=acc_chk_001

202 Accepted
{ "deposit_id": "dep_a31…", "state": "received",
  "provisional_credit_at": "2026-05-03T12:00:00Z" }

// Later, server-to-server:
POST https://your-app.example.com/webhooks/desco
{ "event": "rdc.posted", "deposit_id": "dep_a31…",
  "final_amount": 250.00, "posted_at": "2026-05-04T18:21:00Z" }

Errors return RFC 7807 problem+json with type, title, status, detail; rate limits are advertised through X-RateLimit-Remaining headers.

Regulatory framing

US credit unions sit at the intersection of several frameworks. The CFPB finalized its open-banking rule under Section 1033 of the Dodd-Frank Act in October 2024; although the rule has been stayed and reopened for comment in 2025, its data-rights framing already shapes how third parties should request and store member data. We also align with NCUA cybersecurity guidance, GLBA Safeguards, and NACHA operating rules for ACH-touching flows.

Privacy controls we ship

• Per-scope OAuth tokens; no shared "god" credentials
• Member consent records with timestamp, IP, scope, and revocation log
• Field-level redaction for SSN / card / MICR fragments
• At-rest AES-256, in-transit TLS 1.2+, key rotation policy
• Data minimization: only the fields a use case actually needs
• Audit export so the credit union or a regulator can replay any access

Eastman Credit Union

Tennessee-based community CU often cited as a benchmark for US mobile-banking UX. Its app exposes the same balance / transaction / RDC data classes a unified PFM expects.

Delta Community Credit Union

Atlanta-headquartered CU with a broad consumer and SMB footprint; teams syncing transaction exports across both Delta Community and Desco FCU look for one shared schema.

Redstone Federal Credit Union

Alabama-based CU serving aerospace/defense communities; data classes (deposits, loans, RDC) overlap closely with Desco's, so the same FDX mapping reuses cleanly.

ESL Federal Credit Union

Rochester, NY CU with a strong digital banking stack; relevant when a fintech wants Northeast plus Appalachian credit-union coverage in one product.

Wright-Patt Credit Union

Ohio's largest credit union by membership; useful regional anchor when integrators bundle Desco FCU and other Ohio CUs into a single state-wide data feed.

Alternatives FCU Mobile

New York community-development CU; appears alongside Desco FCU in searches for "credit union mobile banking app" and shares a similar backend feature set.

Navy Federal Credit Union

The largest US credit union; teams building member-facing dashboards typically pair Navy Federal coverage with mid-sized CUs like Desco FCU for breadth.

PenFed Credit Union

Tysons, VA-based CU with a national member base; integration parity (balances, transactions, transfers, RDC) lines up with what we ship for Desco FCU.

America First Credit Union

Mountain-West CU with a deep mobile feature set; users who hold accounts here often want a single transaction export covering both AFCU and Desco FCU.

Mountain America Credit Union

Utah-based CU with strong digital adoption; mentioned when an integrator's roadmap targets pan-US credit-union coverage rather than just megabanks.

About us

OpenFinance Lab is an independent studio focused on mobile-app protocol analysis and OpenData / OpenFinance / OpenBanking API integration. Our engineers come from US/EU banking, payments, and security backgrounds, and we ship end-to-end financial APIs under realistic compliance constraints.

• Fintech, retail banking, credit-union and SMB lending integrations
• Custom Python / Node.js / Go SDKs and conformance test harnesses
• Full pipeline: protocol analysis → build → validation → compliance
• Source code delivery from $300 — receive runnable API source code and full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — access our hosted API and pay only per call; ideal for teams that prefer usage-based pricing.

Contact

For quotes, sandbox access, or to submit your target requirements, open our contact page:

Contact page

Two engagement models: source-code delivery (one-time, from $300) or pay-per-call hosted API (no upfront fee).

Engagement workflow

1. Scope confirmation: which data classes and endpoints (login, balances, transactions, transfers, RDC).
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build + internal validation against a test member account (3–8 business days).
4. Docs, samples, and conformance tests aligned to FDX naming (1–2 business days).
5. Typical first delivery: 5–15 business days; aggregator or member-consent approvals may extend timelines.

FAQ

Do I need permission from Desco FCU to integrate the data?

Which data points can I expect to access?

How long does delivery take?

How do you handle compliance?