Till: Debit Card for Kids — API integration & OpenFinance export

Deliverables checklist

• OpenAPI 3.1 specification covering login, balances, transactions, allowance, goals and webhooks
• Protocol and auth-flow report (mobile login, refresh-token rotation, device-binding signals)
• Runnable source for parent-side and kid-side flows in Python (FastAPI) and Node.js (NestJS)
• Postman / Bruno collection plus pytest and jest test suites against a sandbox account
• Compliance pack: FDIC pass-through narrative, CFPB Section 1033 data-rights mapping, COPPA / minor-data handling notes, GLBA safeguard checklist
• Webhook fan-out service for transaction-posted, allowance-paid and goal-completed events

1. Household budgeting dashboard

A consumer-fintech client builds a multi-kid family-budget view. We pull each kid's sub-account balance, the active allowance schedule and the last 90 days of card transactions; the dashboard renders an envelope per child and forecasts the next four weeks of cash outflow. The data path is Till app surface → our authorised extraction layer → /family/{family_id}/forecast. OpenFinance angle: account information aggregation across siblings, equivalent to a consumer-permissioned AIS view in PSD2 terminology.

2. Chore-payout automation for ed-tech

A K-12 financial-literacy product wants to mark in-app coursework as a Till chore so the kid is paid a small bonus on completion. We expose POST /allowance/chore for task creation and a webhook chore.payout.completed for receipt. This binds curriculum events to real money movement, mapped to the "automate allowance" capability described in Till's product copy.

3. Compliance-grade audit log for accountants

A family CPA firm needs an immutable export of every dollar moved into and out of the kid accounts during a tax year. We deliver a signed JSON-Lines bundle of card transactions, transfers, allowance payouts and referral bonuses, plus an FDIC pass-through narrative for the parent-of-record. This satisfies the data-portability spirit of CFPB Section 1033 personal financial data rights.

4. Wallet-provisioning analytics

A card issuer wants to know how many Till kids actually push the card into Apple Wallet or Google Wallet, on which device class, and how that correlates with weekly spend. We stream provisioning events plus a weekly kid_card.spend_rollup message and calculate activation lift versus physical-only cohorts.

5. Acquirer-side reconciliation post-Western & Southern

Following the Western & Southern acquisition of Till Financial announced 27 April 2026, parent-company reporting may need to roll Till sub-ledgers into a wider household balance sheet. We expose a daily settlement-state feed keyed by Till family_id so the holding company can reconcile FDIC pass-through deposits against general-ledger entries.

API example: kid-card transaction query

// Pull a kid's card transaction history with paging
GET /api/v1/till/kids/{kid_id}/transactions?from=2026-04-01&to=2026-04-30&cursor=
Authorization: Bearer <ACCESS_TOKEN>
X-Family-Id: fam_8a0c

200 OK
{
  "items": [
    {
      "id": "txn_01HW...",
      "kid_id": "kid_92",
      "amount_cents": -1299,
      "currency": "USD",
      "merchant": "ROBLOX",
      "mcc": "7995",
      "status": "posted",
      "authorized_at": "2026-04-12T18:21:09Z",
      "posted_at":     "2026-04-13T03:04:51Z"
    }
  ],
  "next_cursor": "eyJvIjoxMDB9"
}

API example: allowance schedule upsert

// Create or update a recurring allowance for a kid
POST /api/v1/till/allowance
Content-Type: application/json
Authorization: Bearer <PARENT_ACCESS_TOKEN>

{
  "kid_id": "kid_92",
  "amount_cents": 1000,
  "currency": "USD",
  "cadence": "weekly",
  "weekday": "SUN",
  "starts_on": "2026-05-10",
  "memo": "weekly allowance"
}

201 Created
{ "schedule_id": "sch_4f2", "next_run_at": "2026-05-10T13:00:00Z" }

API example: webhook for transaction-posted

// Outbound webhook with HMAC signature
POST https://yourapp.example.com/webhooks/till
X-Till-Signature: t=1715212345,v1=8a3c...
Content-Type: application/json

{
  "event": "kid_card.transaction.posted",
  "family_id": "fam_8a0c",
  "kid_id": "kid_92",
  "transaction": {
    "id": "txn_01HW...",
    "amount_cents": -1299,
    "merchant": "ROBLOX",
    "posted_at": "2026-04-13T03:04:51Z"
  }
}

// Verify signature in Node.js
const crypto = require('crypto');
function verify(raw, header, secret){
  const [ts, v1] = header.split(',').map(p=>p.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret)
    .update(`${ts}.${raw}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

Regulatory framing

Because Till accounts hold real consumer deposits at Coastal Community Bank, Member FDIC, every integration we ship is documented against the U.S. financial-services compliance stack. We map data flows to CFPB Section 1033 personal financial data rights for consumer-permissioned aggregation, GLBA Safeguards Rule for transit and at-rest protection, and the Children's Online Privacy Protection Act (COPPA) for any field that identifies a kid under 13. FDIC pass-through insurance up to $250,000 per depositor is documented so a downstream ledger can prove the chain.

Operating principles

• Authorised access only — explicit consent from the parent of record, captured as a signed scope grant
• Data minimisation — extract only the fields the customer's use case requires; redact at the edge
• Token rotation, device-binding signals and short-lived bearer tokens
• Per-kid pseudonymisation for analytics warehouses; full PII is kept inside the encrypted vault
• Optional NDA, on-prem build, and customer-controlled key wrap

About us

OpenFinance Lab is an independent studio focused on app protocol analysis, OpenData / OpenFinance integration and authorised API delivery. Our team includes engineers from card-issuing platforms, U.S. neobanks, OAuth gateways and consent-management vendors, and we have shipped integrations against family-banking, teen-investing and kid-card products across the North American market.

• Family banking, teen investing, neobank and BaaS card programs
• Authorised mobile interface analysis and consent-aware extraction
• Custom Python / Node.js / Go SDKs and OpenAPI-first delivery
• Compliance-aware delivery: FDIC pass-through, CFPB §1033, GLBA, COPPA
• Source code delivery from $300 — runnable API source code and full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — access our hosted endpoints and pay only per call, no upfront cost

Contact

Tell us the data you need from Till — allowance, kid-card transactions, savings goals, funding events, or a custom slice — and we will scope it within one business day.

Contact page

Engagement workflow

1. Scope confirmation: which Till surfaces (allowance, transactions, goals, funding) and which downstream system consumes them
2. Authorised protocol analysis and API design — typically 2–5 business days
3. Build and internal validation against a customer-provided test family — 3–8 business days
4. OpenAPI docs, sample apps and pytest / jest test suites — 1–2 business days
5. Typical first delivery: 5–15 business days; multi-child rollups, webhook fan-out and ACH reconciliation may extend the timeline

FAQ

Do you connect to Till's official API or reverse-engineered endpoints?

Which Till data points can you export?

How long does delivery take?

How do you handle Coastal Community Bank, FDIC and CFPB compliance?