Set up Plaid Link and your OAuth redirect URI

Plaid Link is the window where users pick their bank and log in. To make it work for every bank, including large US banks that use OAuth, you must add your site's redirect URI to the allowlist in the Plaid Dashboard and complete Plaid's OAuth registration steps.

How does the Link flow work?#

Plaid describes the flow in its Link docs (opens in a new tab). Every Plaid integration, BankBridge included, follows these steps.

1. Your server calls /link/token/create and gets a short-lived link_token.
2. The page opens Link with that token, using Plaid's script from https://cdn.plaid.com/link/v2/stable/link-initialize.js.
3. The user picks a bank, logs in and chooses accounts.
4. Link calls onSuccess with a temporary public_token.
5. Your server exchanges it at /item/public_token/exchange for a permanent access_token and an item_id.

Sources: Link (opens in a new tab), Items API (opens in a new tab).

Why do I need a redirect URI?#

Many banks send users to their own website or app to log in, then back to you. Plaid calls this OAuth. Plaid's OAuth guide (opens in a new tab) says OAuth is required for US, EU and UK integrations that connect to banks, and that without it users cannot connect at institutions that require OAuth, "which includes many of the largest banks in the US." Canadian institutions do not currently use OAuth.

How do I register the redirect URI?#

Add the exact URL of the page that hosts your Link button to Plaid's allowlist.

1. Decide which page users return to after the bank login. Use the page that opens Link, or a dedicated return page.
2. In the Plaid Dashboard, open Allowed redirect URIs on the API page (opens in a new tab) and add that URL.
3. Use the same URL in BankBridge's redirect URI setting, so it is sent as redirect_uri when the link token is created.
4. Test with a Sandbox OAuth institution.

Plaid's rules for redirect URIs:

What else does Plaid require for OAuth banks?#

Plaid lists extra steps before real OAuth connections work. From the OAuth guide (opens in a new tab):

1. Get Production access (a paid plan or the Trial plan).
2. Complete the registration requirements in the Dashboard compliance center.
3. Fill in your application display information. Plaid says some US banks reject apps with an empty profile.
4. For US and Canada, sign the latest Master Services Agreement and get your security questionnaire approved.
5. Wait for OAuth approval, which you can track on the OAuth institution page.

Chase requires the security questionnaire for Production access unless you are on a Trial plan. Plaid's changelog notes that from May 20, 2026, Trial plan customers get immediate access to all OAuth institutions.

What happens when the user comes back from the bank?#

When the bank sends the user back, the page reopens Link with receivedRedirectUri set to the full URL they returned on, using the same link_token. Plaid says the returned URL must not carry extra query parameters or fragments beyond what the bank added. Plaid says reinitializing is required for webviews and recommended for mobile web. On desktop web it is not required.

Will my security plugin block Link?#

It can. If your site sends a Content Security Policy header, Plaid's web docs (opens in a new tab) say it must allow:

Plaid also says not to self-host or bundle the Link script. It must load from cdn.plaid.com. Turn off any optimization plugin setting that combines or delays that script.

Sources#

Checked October 23, 2026.

• Plaid, Link overview (opens in a new tab)
• Plaid, Link web SDK (opens in a new tab)
• Plaid, OAuth guide (opens in a new tab)
• Plaid, Items API (opens in a new tab)
• Plaid, Changelog (opens in a new tab)

Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.