Neverless API integration services (crypto / gold / OpenFinance)

Deliverables checklist

• OpenAPI / Swagger spec for every endpoint we expose
• Protocol and auth-flow report (OAuth, refresh, 2FA, biometric)
• Runnable source for login, portfolio and statement APIs in Python and Node.js
• Automated test suite hitting sandbox accounts plus replayable fixtures
• Compliance memo covering MiCA, MiFID II and GDPR responsibilities

Engagement options

Two routes, both compliant: (1) Source code delivery from $300 — you receive the full codebase plus docs and only pay after you confirm it works; (2) Pay-per-call API billing — you call our hosted endpoints and pay only for the requests you actually make. We sign NDAs by default and ship under your repo conventions.

1. Multi-venue tax reporting

A boutique tax firm in Dublin needs to file MiCA-aligned year-end packs for clients who hold assets across Neverless and a traditional broker. Our statement export endpoint pulls a full date-range CSV — every trade, every fee — keyed by client UID and joined to the broker's data so the firm can produce one unified pack instead of stitching PDFs by hand.

2. Family-office balance dashboard

A small UK family office tracks a 7-figure crypto allocation alongside equities and gold. We sync Neverless wallet, gold/silver and Strategies™ positions every 15 minutes via the portfolio endpoint, then push deltas into the office's existing PowerBI book using the same OAuth-scoped token chain that gates the mobile app.

3. Recurring-buy automation around Boosted Bitcoin

A retail-facing newsletter wants to let subscribers mirror a Boosted Bitcoin Plan schedule introduced in October 2025. We wrap Neverless's recurring buy and leverage parameters in a thin OpenFinance-style endpoint, with idempotency keys and webhook callbacks so the newsletter's backend can confirm each leg without polling.

4. Borrow-against-crypto liquidity dashboard

A treasury desk that uses Neverless to borrow EUR against held crypto needs an early-warning view on LTV. We expose the borrow position as a typed object (principal, collateral, LTV, interest accrual) and emit a webhook when LTV crosses a configurable threshold — so the desk can repay or top up before a forced reduction.

5. Compliance audit replay

For a MiFID-licensed introducer, we package every API call our integration makes into a tamper-evident log with consent records, request hashes and the exact scope of the OAuth token. Auditors can replay any 24-hour window and prove that no data was pulled outside the user's authorization.

Login & token exchange

POST /api/v1/neverless/auth/login
Content-Type: application/json

{
  "email": "user@example.com",
  "password": "<encrypted>",
  "device_id": "ios-9F2A...",
  "totp_code": "482910"
}

200 OK
{
  "access_token": "nl_at_...",
  "refresh_token": "nl_rt_...",
  "expires_in": 3600,
  "scopes": ["portfolio:read", "statements:read"]
}

Portfolio snapshot

GET /api/v1/neverless/portfolio
Authorization: Bearer <ACCESS_TOKEN>
Accept: application/json

200 OK
{
  "as_of": "2026-05-03T08:00:00Z",
  "base_ccy": "EUR",
  "cash":   [{"ccy":"EUR","amount":"1240.55"},
             {"ccy":"GBP","amount":"82.10"}],
  "crypto": [{"asset":"BTC","qty":"0.1842","value_eur":"11820.40"},
             {"asset":"ETH","qty":"3.20", "value_eur":"9612.00"}],
  "metals": [{"asset":"XAU","grams":"12.5","value_eur":"945.20"}],
  "strategies": {"allocated_eur":"2500.00","return_pct":"0.071"}
}

Statement export & webhook

POST /api/v1/neverless/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "format":    "csv",
  "include":   ["trades","deposits","withdrawals","borrow"]
}

202 Accepted
{ "job_id": "stm_91a3", "callback": "https://your.app/cb" }

// Webhook payload (your endpoint receives):
{ "job_id":"stm_91a3", "status":"done",
  "url":"https://files.openfinance-lab.com/stm_91a3.csv",
  "expires_at":"2026-05-04T08:00:00Z" }

// Error contract — uniform across endpoints:
{ "error":"rate_limited","retry_after":7,"trace_id":"..." }

Compliance & privacy

Neverless operates as a MiFID investment firm via a Bank of Latvia license and as a Virtual Asset Service Provider, so every integration we ship has to honor the EU's Markets in Crypto-Assets (MiCA) Regulation as well as MiFID II investor-protection rules and GDPR. Tokens are scoped per user, refresh chains are short-lived, and request/response payloads are stripped of personal data before any logging.

For UK-resident users we additionally check FCA financial-promotion rules so that data we surface (e.g. leveraged Boosted Bitcoin schedules) is presented inside your UI with the disclaimers your legal team requires. Identity onboarding mirrors Neverless's own KYC stack — the platform publicly documents the use of Sumsub for verification, with median check times of about 18 seconds.

Data flow / architecture

A typical Neverless integration looks like this:

1. Client app — iOS / Android / web that initiates the OAuth + 2FA flow.
2. Ingestion API — our hosted gateway that handles tokens, throttling and retries.
3. Storage layer — PostgreSQL + object store for raw statements, with at-rest encryption.
4. Analytics / API output — typed REST endpoints, webhooks, or scheduled CSV / PDF drops.

Each hop logs only structured metadata (request id, scope, latency); raw account balances never leave the storage tier in plaintext.

About us

OpenFinance Lab is an independent studio focused on fintech protocol analysis and OpenData / OpenFinance / OpenBanking integration. Our engineers come out of crypto exchanges, EU neobanks and payment-gateway teams, and we have shipped integrations against MiFID-licensed venues, PSD2-regulated banks and a dozen wallet apps.

• Crypto and digital-asset platforms, neobanks, brokers and insurtech
• OAuth, mTLS and reverse-engineered mobile auth flows
• Custom Python, Node.js and Go SDKs plus reusable test harnesses
• Full pipeline: protocol analysis → build → validation → compliance memo
• Source code delivery from $300 — runnable code and docs, paid after acceptance
• Pay-per-call API billing — hosted endpoints, only pay for what you actually call

Contact

Tell us your target app, the data fields you need, and any deadlines. We reply within one business day with scope, price and a delivery date.

Open contact page

Engagement workflow

1. Scope confirmation — we agree the exact data set (e.g. balances, statements, Strategies™, borrow).
2. Protocol analysis & API design — typically 2–5 business days.
3. Build & internal validation against sandbox accounts — 3–8 business days.
4. Docs, samples and replayable test cases — 1–2 business days.
5. First delivery usually lands in 5–15 business days; multi-asset stacks may extend.

FAQ

What do you need from me to start a Neverless integration?

How long does a typical Neverless API delivery take?

How do you handle MiCA, MiFID II and GDPR compliance?

Which engagement model fits a small team best?