POST
/v1/financial_connections/sessionsCreate a Session
To launch the Financial Connections authorization flow, create a Session. The session’s client_secret can be used to launch the flow using Stripe.js.
- RetriesRetries up to 2×, 500ms backoff, 30s timeout.
- IdempotentThe SDK sends
Idempotency-Key, so a retried request is only applied once.
account_holderobjectrequired
The account holder to link accounts for.
expandarray<string>optional
Specifies which fields in the response should be expanded.
filtersobjectoptional
Filters to restrict the kinds of accounts to collect.
limitsobjectoptional
Settings for configuring Session-specific limits.
manual_entryobjectoptional
Customize manual entry behavior
permissionsarray<string>required
List of data features that you would like to request access to.
Possible values are `balances`, `transactions`, `ownership`, and `payment_method`.
prefetcharray<string>optional
List of data features that you would like to retrieve upon account creation.
return_urlstringoptional
For webview integrations only. Upon completing OAuth login in the native browser, the user will be redirected to this URL to return to your app.
200Successful response.
account_holderobjectoptional
The account holder for whom accounts are collected in this session.
accountsobjectrequired
The accounts that were collected as part of this Session.
bank_account_tokenobjectoptional
Tokenization is the process Stripe uses to collect sensitive card or bank
account details, or personally identifiable information (PII), directly from
your customers in a secure manner. A token representing this information is
returned to your server to use. Use our
[recommended payments integrations](https://docs.stripe.com/payments) to perform this process
on the client-side. This guarantees that no sensitive card data touches your server,
and allows your integration to operate in a PCI-compliant way.
If you can't use client-side tokenization, you can also create tokens using
the API with either your publishable or secret API key. If
your integration uses this method, you're responsible for any PCI compliance
that it might require, and you must keep your secret API key safe. Unlike with
client-side tokenization, your customer's information isn't sent directly to
Stripe, so we can't determine how it's handled or stored.
You can't store or use tokens more than once. To store card or bank account
information for later use, create [Customer](https://docs.stripe.com/api#customers)
objects or [External accounts](/api#external_accounts).
[Radar](https://docs.stripe.com/radar), our integrated solution for automatic fraud protection,
performs best with integrations that use client-side tokenization.
client_secretstringoptional
A value that will be passed to the client to launch the authentication flow.
filtersobjectoptional
idstringrequired
Unique identifier for the object.
limitsobjectoptional
livemodebooleanrequired
If the object exists in live mode, the value is `true`. If the object exists in test mode, the value is `false`.
manual_entryobjectoptional
objectstringrequired
String representing the object's type. Objects of the same type share the same value.
permissionsarray<string>required
Permissions requested for accounts collected during this session.
prefetcharray<string>optional
Data features requested to be retrieved upon account creation.
return_urlstringoptional
For webview integrations only. Upon completing OAuth login in the native browser, the user will be redirected to this URL to return to your app.
defaultError response.
errorobjectrequired
Error handling
Any other status is an error: Error response.