Launch Credit Union API integration services (FDX / OpenBanking)

Deliverables checklist

• OpenAPI / Swagger 3.1 spec covering login, accounts, transactions, statements and webhooks
• Protocol & auth flow report (token chain, certificate pinning, MFA branches, device-binding)
• Runnable reference clients in Python (httpx + Pydantic) and Node.js (TypeScript + zod)
• Postman collection plus contract tests against a sandbox member fixture
• Compliance package: NCUA / GLBA mapping, Section 1033 consent template, retention & revocation playbook
• Operational runbook: rate limits, retry/backoff, alerting on auth-flow drift after app updates

Engagement models

Two pricing options are available so teams can choose between owning the integration outright or paying only for what they use:

• Source code delivery from $300 — receive the runnable API source code, OpenAPI spec and full documentation; pay after delivery upon satisfaction.
• Pay-per-call API billing — call our hosted endpoints and pay only for successful responses, no upfront fee, ideal for low-volume pilots.

1. Personal-finance aggregation

Pull Account list + Transaction history nightly, normalize merchant strings, and push into a household budgeting app. Maps to the FDX /accounts and /accounts/{id}/transactions endpoints under a read_accounts consent scope. Refresh tokens rotate every 90 days to satisfy the credit union's session policy.

2. Small-business bookkeeping sync

Members holding a Launch CU business checking account can authorize one-way export to QuickBooks/Xero-style ledgers. We deliver categorised transactions plus monthly statement PDFs, and emit a webhook on every new posted transaction so reconciliation runs in near real time instead of via daily polls.

3. Loan underwriting & cash-flow scoring

For external lenders, surface 24 months of statements plus payroll-pattern detection from the deposit stream. Field-level mapping (e.g. ACH originator, deposit cadence) feeds a cash-flow score; the consent record is signed and stored to satisfy NCUA examination evidence.

4. Mobile-deposit funds-availability UX

Third-party financial wellness apps can show a member when their mobile deposit holds release. The integration reads the mobile deposit history added in the Nov 2024 app release, computes the next-available date and pushes a calendar event — the value Launch added on-device is reflected off-device too.

5. Compliance & audit data room

Auditors pull a member's full statement archive plus card transaction events into an evidence locker. The flow follows OpenBanking-style strong customer authentication: the member explicitly authorizes a time-bounded scope, and revoking it stops new pulls while leaving historical records intact for the retention window.

1. Member authentication (login + MFA)

POST /api/v1/launchcu/auth/login
Content-Type: application/json

{
  "username": "member_handle",
  "password": "<hashed_password>",
  "device_id": "uuid-v4",
  "device_name": "iPhone 15"
}

200 OK
{
  "mfa_required": true,
  "mfa_token": "tx_9f3c...",
  "channels": ["sms", "email", "push"]
}

POST /api/v1/launchcu/auth/mfa
{ "mfa_token": "tx_9f3c...", "code": "482910" }

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_2d8e...",
  "expires_in": 1800,
  "member_id": "M-0042331"
}

2. Statement query (FDX-shaped)

POST /api/v1/launchcu/statements
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "ACC-CHK-118",
  "from_date": "2025-11-01",
  "to_date":   "2026-04-30",
  "format":    "json+pdf"
}

200 OK
{
  "account": {
    "id": "ACC-CHK-118",
    "type": "CHECKING",
    "currency": "USD"
  },
  "statements": [
    {"period":"2026-04","pdf_url":"https://.../stmt-2026-04.pdf","opening":1234.56,"closing":1819.20},
    ...
  ]
}

3. Transaction webhook (push delivery)

POST {your_endpoint}
X-Launchcu-Signature: t=1715200000,v1=...
Content-Type: application/json

{
  "event": "transaction.posted",
  "member_id": "M-0042331",
  "account_id": "ACC-CHK-118",
  "txn": {
    "id": "T-9f02ab",
    "amount": -42.18,
    "currency": "USD",
    "merchant": "PUBLIX #1112",
    "mcc": "5411",
    "posted_at": "2026-05-08T14:21:03Z"
  }
}

# Verify HMAC-SHA256 over the raw body using your shared secret.
# Reject events older than 5 minutes to limit replay risk.

Regulatory framework

Launch Credit Union is a U.S. credit union supervised by the National Credit Union Administration (NCUA) and its share deposits are insured up to applicable limits. Any integration we deliver respects the Gramm-Leach-Bliley Act (GLBA) safeguards and privacy rules, mirrors the mobile app's strong-customer-authentication behaviour, and aligns with Section 1033 of the Dodd-Frank Act as it currently stands (the CFPB paused its 1033 implementation in July 2025, but the underlying right of access has not been removed). Where the data recipient is itself a financial institution, we additionally apply FFIEC IT Examination Handbook controls.

Privacy & consent posture

• Authorized or documented public APIs only — no credential resale, no shared logins.
• Member-scoped consent records with timestamp, scope list, IP, and revocation hook.
• Field-level minimisation: each downstream system gets only the fields it actually consumes.
• Encryption at rest (AES-256) and in transit (TLS 1.2+); secrets stored in HSM-backed vaults.
• Operator playbook for breach detection, retention purges, and member-facing access logs.

About OpenFinance Lab

We are an independent technical studio focused on App interface integration, OpenData and OpenFinance. Our team includes engineers from U.S. and EU banks, payment processors, and mobile reverse-engineering shops. For credit unions specifically, we have shipped FDX-shaped integrations against members of Apiture, Banno, Alkami, and Q2 stacks, so we already know how mobile clients on this category typically handle authentication, certificate pinning and statement delivery.

• Retail banking, lending, accounting, and fintech infrastructure
• OAuth 2.0 / OIDC / FAPI 2.0, FDX 5.x, FFIEC-aligned controls
• Custom Python / Node.js / Go SDKs, OpenAPI generators, contract tests
• End-to-end pipeline: protocol analysis → build → validation → compliance package
• Source code delivery from $300 — runnable code plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — call hosted endpoints with no upfront cost; ideal for usage-based pricing

Contact

Send us your target app and concrete data scope (e.g. transactions, statements, mobile deposit history) and we will reply with a deliverables list and a fixed-price quote.

Contact page

Engagement workflow

1. Scope confirmation: which data (login, statements, mobile deposits, card events) and downstream system.
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build and internal validation against a test member fixture (3–8 business days).
4. Docs, samples, contract tests, and the compliance package (1–2 business days).
5. Typical first delivery: 5–15 business days; downstream integrations or webhook fan-out add 2–4 days.

FAQ

What does an integration with Launch Credit Union typically expose?

How long does delivery take?

How do you handle compliance for U.S. credit union data?

Do you support both Android and iOS clients?