MCCU Houston TX API integration (OpenBanking / Section 1033)

Deliverables checklist

• OpenAPI 3.1 specification covering authentication, accounts, statements, transfers, Zelle and card controls
• Protocol report: TLS pinning, login challenge sequence, token chain, refresh window, e-Alert webhook patterns
• Runnable Python and Node.js source — login adapter, statement crawler, Zelle event subscriber, card-control client
• Pytest / Jest fixtures with redacted sample responses, plus a Postman collection
• Compliance pack: GLBA / Reg E mapping, retention and consent guidance, NCUA-aware logging template
• Optional: Plaid-, MX- or Finicity-compatible JSON adapter so MCCU rows fit existing aggregator schemas

What stays out of scope

We never bypass MFA, never store member credentials in plaintext, and never resell extracted data. Where MCCU exposes a feature behind step-up auth (large transfers, profile changes), the delivered code surfaces the challenge to the caller rather than attempting to suppress it.

1. Accounting sync for a Katy small business

A West Houston construction firm runs payroll out of an MCCU Business Checking account and books revenue in QuickBooks Online. We deliver a connector that authenticates against MCCU, calls a paginated /transactions endpoint nightly, and pushes normalized journal entries to QBO. Field mapping covers amount, posted_at, merchant, memo, and a derived category. This maps directly to the Section 1033 "personal financial data rights" pattern: the member, not the institution, controls the export.

2. Multi-institution net-worth dashboard

A financial-planning startup wants MCCU accounts to appear next to balances pulled from Chase and Fidelity. We deliver an adapter that emits Plaid-compatible JSON (accounts.balance.get, transactions.sync) so MCCU rows slot into the existing aggregator pipeline. This avoids the cost spike that has emerged since major aggregators began moving toward paid API access.

3. Real-time fraud signal via card-control state

An anti-fraud SaaS subscribes to a webhook that fires whenever a member toggles their MCCU debit card to "blocked" via the in-app card feature. The event includes a card token (never the PAN), timestamp, and the channel. The SaaS uses this as a high-confidence signal to step up authentication on adjacent merchant flows for the same member.

4. Pre-approved auto-loan offer ingestion

An auto-shopping marketplace surfaces MCCU's personalized pre-approved loan offers and current promotional rates inside its checkout funnel. The connector reads /loans/offers and /rates/current, normalizes APR / term / fees, and the marketplace renders an "MCCU Houston TX rate" tile alongside other lenders. All offer events are logged for audit.

5. Compliance-grade Zelle® reconciliation for a Houston nonprofit

A Houston nonprofit accepts donations by Zelle® into an MCCU account and must tie each receipt to a donor record. We deliver a poller that fetches Zelle activity, dedupes against a local store, and emits a webhook to a CRM with sender alias, amount, settlement window, and a generated reference. This satisfies bookkeeping, donor receipting, and the IRS substantiation requirements that govern recurring giving.

Login & session refresh

// Pseudocode: MCCU login flow
POST /api/v1/mccu/auth/login
Content-Type: application/json

{
  "username": "<member_username>",
  "password": "<member_password>",
  "device_id": "<hashed_device_uid>",
  "biometric_assertion": "<optional_face_or_touch_token>"
}

// 200 OK
{
  "access_token": "eyJhbGciOi…",
  "refresh_token": "rfr_…",
  "expires_in": 1800,
  "step_up_required": false,
  "alert_emitted": true        // MCCU emits an email/SMS login alert
}

Statement & transaction query

// Pseudocode: paged transactions for one MCCU account
POST /api/v1/mccu/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "acct_chk_8842",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "page_size": 100,
  "cursor":    null,
  "include":   ["zelle", "ach", "card", "atm", "deposit"]
}

// 200 OK (truncated)
{
  "items": [
    {"id":"txn_…","posted":"2026-04-29","amount":-42.18,"type":"card",
     "merchant":"HEB #345 KATY TX","memo":"GROCERIES","running_balance":1284.55},
    {"id":"txn_…","posted":"2026-04-28","amount": 1500.00,"type":"deposit",
     "memo":"MOBILE CHECK DEP","image_hash":"sha256:…"}
  ],
  "next_cursor": "c_…"
}

e-Alert webhook (login & balance)

// Pseudocode: webhook your service receives
POST https://your.app/webhooks/mccu
X-MCCU-Signature: t=1715301812,v1=…

{
  "event_id":   "evt_01HXY…",
  "event_type": "auth.login.success",     // or "balance.low", "deposit.posted"
  "occurred_at":"2026-05-10T14:11:02Z",
  "member_ref": "mb_…",
  "payload": {
    "channel": "mobile_app",
    "ip":      "203.0.113.42",
    "user_agent":"MCCU-Houston-TX/iOS/9.x"
  }
}

// Verify HMAC, dedupe by event_id, then dispatch to CRM / Slack / SIEM.

Section 1033 / CFPB Personal Financial Data Rights

In October 2024 the CFPB finalized a rule under Section 1033 of the Dodd-Frank Act giving consumers the right to access and share their financial data. In July 2025 the CFPB paused implementation and in August 2025 issued an Advanced Notice of Proposed Rulemaking with 36 questions covering security, privacy, fees and the definition of "consumer." Our delivered code is built so that switching between free and paid aggregator models — the live debate of 2025 — is a configuration change, not a rewrite.

What we always do

• Operate under explicit member authorization with revocable consent
• Honor TLS pinning and never persist plaintext credentials
• Emit consent and access logs that survive audit (timestamp, scope, requester)
• Apply data minimization — only the fields the use case actually needs
• Support NDAs and per-engagement DPAs on request

First Service Credit Union

Houston-area credit union with a mobile app covering checking, auto loans, mortgages and personal loans. Members who also bank at MCCU often need consolidated transaction exports across both institutions.

TDECU (Texas Dow Employees Credit Union)

A large Texas credit union with a digital-banking app and a strong loan book. Integration teams use it as a reference for how Texas credit-union APIs handle joint accounts and loan payoff queries.

First Community Credit Union (FCCU)

Open to members who live, work, attend school or worship in served Texas counties. Its app holds checking, savings, card and loan data that maps cleanly onto the same OpenBanking endpoint shapes used here.

Texas Bay Credit Union

One of Houston's longest-running credit unions, founded in 1936. Apps that aggregate "Houston banking" data benefit from a connector that treats Texas Bay records identically to MCCU records.

PrimeWay Federal Credit Union

Houston-headquartered federal credit union frequently surfaced as a peer to MCCU in local "best credit union" lists. Its mobile app exposes similar transaction and card-control surfaces.

Harris County Federal Credit Union

Serves around 18,000 Harris County members across checking, savings, investments and lending. Multi-institution dashboards typically pair Harris County FCU activity with MCCU activity on the same family ledger.

Space City Credit Union

Smaller Houston credit union whose data model fits the same Section 1033 export pattern. A shared adapter saves implementation cost when both Space City and MCCU members sign up.

Houston Police Credit Union

Affinity credit union for Houston-area law-enforcement members. Builders of compliance-focused dashboards often need to align HPCU and MCCU statements for joint household reporting.

Houston Texas Fire Fighters Federal Credit Union

Full-service institution with $250M+ in assets. Its app holds the same family of consumer-financial data and integrates well into the same OpenFinance pipeline used for MCCU.

About OpenFinance Lab

We are an independent technical studio focused on app interface integration and authorized API integration for global clients. Our team has multi-year experience in mobile applications and fintech, with engineers who have shipped production code for banks, payment gateways, and aggregators.

• Personal banking, credit unions, lending, and small-business finance
• Protocol analysis (TLS, login challenge, token chains) for Android and iOS apps
• Custom Python / Node.js / Go SDKs and test harnesses
• Full pipeline: protocol analysis → build → validation → compliance review
• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted API and pay only per call, no upfront cost

Contact

Send us the target app (already provided: MCCU Houston TX) and your concrete needs — for example, "nightly transaction export for two MCCU checking accounts into QuickBooks," or "Zelle webhook into our CRM." We will return a scope and a fixed-fee quote.

Contact page

Engagement workflow

1. Scope confirmation: integration scenarios and API needs (login, statements, Zelle, deposits, card controls)
2. Protocol analysis and API design (2–5 business days, complexity-dependent)
3. Build and internal validation against an authorized member account (3–8 business days)
4. Documentation, sample requests, and test cases (1–2 business days)
5. Typical first delivery: 5–15 business days; third-party approvals or aggregator certification may extend timelines

FAQ

What MCCU Houston TX data can be exposed via API?

How long does delivery take?

How do you handle compliance for credit-union data?

Can you connect MCCU data to Plaid, MX or Finicity?