Best embedded finance APIs: 16 compared by layer

Embedded finance APIs let a software platform add accounts, payments, cards or financing to its own product while a bank or licensed provider holds the regulated part. This list of best embedded finance APIs, chosen on published criteria, covers 16 APIs from 14 providers that publish an API reference readable without signing in, document a sandbox and run a live U.S. program. Each entry reports only what the provider’s own documentation says. The list is not a ranking.

How these APIs were selected

Three criteria, applied before anything else:

1. A public API reference that can be read without signing in.
2. A sandbox or test environment described in that documentation.
3. A live U.S. program.

Everything past those three is reported as published. Where a provider publishes no figure, the table says “Not published”; nothing here is estimated, scored or picked. Entries are alphabetical within each layer and the order carries no meaning. No provider paid for inclusion.

Parafin is excluded on the first criterion: its developer documentation and API reference require an access code. Its public GitHub repositories show a webhooks quickstart with sandbox event triggers and a React embed, but the reference itself cannot be read.

For the products and the question of who holds the licence, see what is embedded finance and b2b embedded finance. More of this coverage sits in the embedded finance archive.

Embedded finance APIs compared

Only published facts are in the table. “Not published” means the pages reviewed carry no figure.

Accounts and money movement

Providers in this layer either are the bank or contract with one. The models behind them are set out in baas platform, banking as a service providers and baas vs banking as a platform.

Column uses HTTP Basic with the API key as password, and sandbox and production keys are created in the developer dashboard (authentication). Its docs say the sandbox mirrors production: “Every route is sandboxed and data persists exactly like in production” (sandbox and testing), Federal Reserve operating hours included. Webhooks are HMAC SHA-256 signed and, when delivery fails, retried up to 25 times within three days (events and webhooks). Coverage on docs.column.com: FBO, sweep, clearing and custom accounts; ACH, domestic and international wires, checks and loans; FedNow and RTP; card programs.

Increase hands over a production key and a sandbox key at sign-up “in which no real money moves”, over Bearer authentication, and maintains open-source SDKs for TypeScript, Python, Go, Java, Ruby, PHP, Kotlin and C#/.NET (API overview). Event Subscriptions carry webhooks, and sandbox simulation calls fire them as well. A rate_limited_error with HTTP 429 is documented, without a number. Its fee schedule lists same-day ACH origination at $2.00 per transaction, next-day ACH at $0.50, wire origination at $15.00, RTP and FedNow at $2.50 each and virtual card creation at $0.25, with custom pricing for platforms moving funds for their customers. The page names Increase Bank, Grasshopper Bank, N.A., First Internet Bank of Indiana and Core Bank; Increase Bank was announced on July 29, 2026.

Lead Bank uses OAuth2 client credentials, with a bearer token valid 24 hours by default and scopes covering accounts, account numbers, ACH, wires, instant payments, internal transfers, lending, fundings, subledger balances, blockchain payments, entities and applications (overview). Sandbox access is not self-serve: “Your Technical Account Manager provides sandbox credentials” at kickoff, and “Production limits are set per program and defined in your contract” (sandbox). Webhooks are HMAC SHA-256 signed and retried every three hours for up to 24 attempts (webhooks).

Newline, a division of Fifth Third Bank, N.A., authenticates with JSON Web Tokens in both sandbox and production: a program UID and HMAC key produce a signed JWT that is exchanged for an eight-hour access token (authentication guide, page dated March 27, 2026). Newline sets the sandbox up itself, working with the Relationship team and sending keys by secure email (API authentication), and warns it “does not contain all of the features available in our Production environment” (sandbox walkthrough). Webhooks are HMAC-signed and retried up to three times, with queue-based consumption as an alternative (webhooks). The API carries ACH, wires, book transfers and RTP, commercial credit and prepaid debit cards and FDIC-insured accounts; FedNow is listed as not yet available.

Synctera takes a Bearer API key against a separate sandbox host, supports Idempotency-Key and mentions 429 responses without a number (need to know). Its setup guide says “You can use all of these APIs in our sandbox”, while production use depends on the products a fintech subscribes to (dev setup). Webhooks are HMAC SHA-256 signed and retried “until a successful response is received or 55 hours have passed” (webhooks guide). The reference groups personal and business customers, accounts, cards, internal transfers, payment schedules, ACH, mRDC, KYC/KYB and document verification and disclosures.

Treasury Prime asks developers to “create a free Developer Sandbox account” and authenticates over HTTP Basic with an API Key ID as username and the secret as password (docs). Guides cover account opening, KYC/KYB vendor integrations, statements, 1099-INT, card issuance and the authorization loop, ACH, incoming ACH and wires. Webhook deliveries are retried up to 15 times on exponential backoff (webhook reference); some endpoints may return 429 in high volume, with no number given (introduction).

Unit runs sandbox and live environments, the sandbox adding simulation operations “from incoming payments to card spend”, and authenticates with OAuth 2.0 bearer tokens in organization and customer form (using the API). It ships an OpenAPI 3.0 spec with Unit-authored Ruby and Java libraries and community Ruby, TypeScript and Python ones. Its rate limit is 1,000 requests per minute per IP address, counted separately for sandbox and live: the only such number published in this layer. Webhooks carry an HMAC SHA1 signature with at-most-once or at-least-once delivery (webhooks). Unit describes its architecture as a direct connection to Fedwire, FedACH and Check21.

Payments for platforms

This layer processes payments on behalf of a platform’s users. The contractual models behind it are in embedded payments, payfac vs payfac as a service and payment gateway api.

Adyen for Platforms covers onboarding a platform’s users, processing payments for them and paying out their funds, with card issuing, business accounts and business financing as further products; the United States, including Puerto Rico, is among the supported countries (platforms docs). Authentication is an API key in the x-API-key header or Basic (API authentication), and platform endpoints have a test host. Server libraries reach C#, Go, Java, Node, PHP and Ruby through Composer, Gradle, Maven, npm, NuGet, PyPi and RubyGems (libraries). Platform webhooks are documented; rate limits are not published on the pages reviewed. Pricing shows a fixed processing fee of $0.13 plus a payment-method fee, with other products priced separately and no platform-specific figures.

Finix uses HTTP Basic with a username and password pair, and keeps Sandbox and Live as separate accounts with separate credentials; Live access goes through a Finix point-of-contact (API docs). It covers online, in-person and platform payments and payouts. Webhooks are signed HMAC-SHA256, accept Basic or Bearer auth on delivery and are retried up to 10 times (webhooks). The one library is a Java SDK whose repository states it is “not receiving regular updates or improvements” (finix-java). Its pricing page offers “flat rate, dynamic, or custom pricing” with no figures, so pricing is not published.

Stripe Connect is for platforms and marketplaces that move money between multiple parties, with onboarding and verification, charges, balances, payouts and embedded components (Connect docs). API keys authenticate over HTTP Basic, bearer is accepted, and keys are split into sk_test_, sk_live_ and restricted forms (authentication). Libraries cover Ruby, Python, Go, Java, Node, PHP and .NET on the server, Stripe.js and React Stripe.js on the web and iOS, Android and React Native on mobile (SDKs). Rate limits are 100 requests per second in live mode and 25 in sandbox, with 30 account creations per second live and 5 in sandbox. Connect integrations need separate webhook endpoints for sandbox accounts (Connect webhooks). Pricing charges the platform nothing where Stripe handles pricing; where the platform handles pricing it is $2 per monthly active account and 0.25% + 25c per payout sent, with Instant Payouts at 1% of payout volume.

Card issuing

These four are issuer processors rather than banks. The roles around them are set out in how to choose an issuer processor and virtual card issuance.

Highnote exposes a GraphQL API with Basic authentication over a base64-encoded API key and separate Test and Live endpoints (using the API). The Test environment “replicates the full functionality of the Live environment” and simulates real-time transactions and compliance scenarios (testing). Rate limits are published: 200 requests per 10 seconds aggregated across an organization’s API keys, 5,000 query complexity per 10 seconds, and Test at 50% of Live by default. Notifications go out as webhooks, up to 50 active ones, HMAC-signed, with nine retries on exponential backoff in Live (notifications). SDKs and pricing are not published on the pages reviewed.

Lithic authenticates with a secret API key in the Authorization header (API basics). The sandbox is open to sign-ups and, in Lithic’s words, “No real money or card transactions occur here”; moving to production means contacting Sales (environments). Rate limits are 30 read and 5 write requests per second in production and 15 and 1 in sandbox. Libraries cover Go, Java, Kotlin, NodeJS and Python (API libraries), and the Events API carries webhooks. Its pricing page publishes no figures; it lists card issuing, fraud controls, accounts, ACH and wire transfers and a processor gateway, with Processor Client and Lithic Program Management as service options.

Marqeta enforces HTTP Basic authentication on the Core API, with the application token as username and a separate sandbox base URL (authentication). Developers create their own account and sandbox and simulate transactions there (quick start). Rate limits are set at program level as one aggregated throughput limit across Core API calls, with authorization traffic excluded, so there is no single published number; token requests are throttled to three within 60 seconds. Webhooks are sent as events occur, with an HMAC_SHA_256 signature recommended and Basic-auth credentials on the endpoint. SDKs and pricing are not published on the pages reviewed.

Thredd runs sandbox access through its Developer Portal, where sign-up opens the REST API via an API Explorer or a Postman collection and a client ID and secret produce an OAuth2 access token (portal access). Webhook endpoints must have their IP whitelisted by Thredd support, and a failed delivery is retried up to three times (webhooks). On March 19, 2024 Thredd processed its first U.S.-issued debit transaction, with B4B Payments (press release), and on June 17, 2026 it named sutton bank as BIN sponsor for U.S. prepaid and debit programs (press release). SDKs, rate limits and pricing are not published on the pages reviewed.

Lending

Both entries come from providers already in the payments layer, which is how platform financing is usually sold: on top of the payment flow the platform already owns.

Adyen Capital API embeds business financing for a platform’s users as grants, with offers based on Adyen’s risk assessment and repayment terms of 90, 180 and 360 days; variable terms are described as being in a pilot phase (Capital overview, grant offers). Authentication, libraries and the test environment are Adyen’s. U.S. availability of Adyen Capital is not confirmed on the pages reviewed, so it is unverified here; webhook coverage specific to Capital is not stated either.

Stripe Capital for platforms is in public preview and, per Stripe, “only available to Connect platforms”: the platform sends financing offers to connected accounts and “Stripe manages the underwriting and servicing” (Capital overview). Financing types include loans, cash advances, loan advances and a line of credit from different banking and financing partners, which vary by business country. Integration is by no-code, embedded components or API. Pricing is not published.

What to check before you integrate

The supervisory documents address banks, not platforms, so the practical use of them is knowing what a bank will ask and what a platform should confirm in writing.

The Federal Reserve, FDIC and OCC issued a joint statement on bank arrangements with third parties for deposit products on July 25, 2024. It says it “reemphasizes existing guidance; it does not alter existing legal or regulatory requirements”, and it names the parties in scope: intermediate platform providers, processors, middleware providers, aggregation layers and program managers.

• System of record. The agencies warn that a lack of sufficient bank access to the deposit and transaction system of record can impair the bank’s ability to determine its deposit obligations. Ask whose ledger is authoritative and how the bank reads it.
• Compliance ownership. However functions are split, “the bank remains responsible for failure to comply with applicable requirements” — the statement names Regulation E dispute timeframes and Regulation DD disclosures.
• Deposit insurance wording. End users may not realize access to funds can depend on the third party, and that deposit insurance does not cover the third party’s own failure. Claiming pass-through coverage without saying that certain regulatory requirements must be satisfied can be a misrepresentation under 12 CFR part 328.
• Chains of parties. Multiple levels of third parties and subcontractors, where the bank has no direct contract with an entity performing crucial functions, are flagged as a challenge.

The interagency guidance on third-party relationships of June 6, 2023 (88 FR 37920, June 9, 2023) covers the life cycle: “planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination”. Its contract points translate into API questions: “the banking organization’s ability to access its data in an appropriate and timely manner”, the right to audit, and whether the contract should bar assignment, transfer or subcontracting without consent.

Where those expectations have failed in practice is visible in the sponsor bank enforcement actions tracker and in how to read a consent order.