How Plaid Works: A Guide for Business Owners

Plaid works by putting a secure window, called Plaid Link, on your website or app where your customer logs in to their bank and picks the accounts to share. Plaid then gives your server tokens, and your server uses those tokens to ask Plaid for exactly the data or payment details your business needs, such as account and routing numbers, balances or the account owner's name. Your business pays Plaid's fees; your customer pays nothing.

What is Plaid, in one paragraph?#

Plaid is a company that connects apps and websites to their users' bank and financial accounts, with the user's permission. Plaid describes itself as "founded on the principle that people have a right to their financial information" on its How we handle data (opens in a new tab) page, which also says more than 7,000 financial apps and services use Plaid. For a business, Plaid is two things: a front-end component your customer sees (Link), and an API your server calls to get data or move money.

What happens when a customer connects a bank?#

A customer connects a bank in about four steps, and your server does most of the work behind the scenes. Here is the standard flow from Plaid's Link overview (opens in a new tab):

1. Your server asks Plaid for a link_token. It calls /link/token/create and says which Plaid products and countries it needs. The token lasts 4 hours, or 30 minutes when it is used to repair an existing connection.
2. Your page opens Plaid Link with that token. On the web, Link loads from Plaid's own script at cdn.plaid.com. Plaid says not to self-host or bundle that script.
3. The customer logs in and picks accounts. At many large US banks, the customer is sent to the bank's own site to approve access (this is OAuth), then returned to your site.
4. Link hands your page a public_token. Your page sends it to your server, which swaps it for a permanent access_token by calling /item/public_token/exchange. The public_token expires after 30 minutes.

From then on, your server uses the access_token to call Plaid products for that connection. The customer does not need to log in again unless something changes, such as a new bank password.

What are Items and tokens?#

An Item is a customer's login at one financial institution, and tokens are the keys your server uses to work with it. Plaid's glossary (opens in a new tab) puts it simply: "An Item represents a login at a financial institution." The table below explains each token in plain terms, based on Plaid's Link (opens in a new tab) and Items (opens in a new tab) docs.

Plaid says the access_token "should be stored in a persistent, secure manner." If a customer disconnects, or you offboard them, your server calls /item/remove, which invalidates the access token and any processor tokens tied to it. For subscription products like Transactions, calling /item/remove is also what stops the monthly fee.

What are Plaid's main products?#

Plaid's products are separate services you turn on for each connection, and you pay only for the ones you use. Plaid's docs home (opens in a new tab) groups them like this:

For most websites, the useful set is small. A store that wants bank payments typically starts with Auth, then adds Balance or Signal to cut down on failed ACH debits and Identity to confirm the account belongs to the buyer. A membership or lending site might add Identity Verification at signup.

How does Plaid help a business take bank payments?#

Plaid helps with bank payments in two ways: it hands verified account details to your payment processor, or, in the US, it moves the money itself. According to the Auth docs (opens in a new tab), Auth "must be used with a payment processor." You can use a Plaid partner, in which case your server creates a processor token and the partner handles the money, or you can read the numbers with /auth/get and send them to your own processor.

The other route is Plaid Transfer, a US-only payment platform that supports ACH, RTP, RfP, wire and FedNow, plus recurring transfers and refunds. You must apply for Transfer and be approved before going live. Our guide to ACH for membership sites shows how recurring transfers work.

What does your customer see and control?#

Your customer sees Plaid Link, their bank's login (inside Link or on the bank's own site), and a list of accounts to choose from. Plaid's How we handle data (opens in a new tab) page says:

• Plaid uses "the Advanced Encryption Standard (AES-256) and Transport Layer Security (TLS)" to protect data.
• It requires multi-factor authentication for access to its own systems.
• People can visit Plaid Portal to view the data types they have shared through Plaid and control ongoing access.

Plaid's pricing page (opens in a new tab) also says consumers can use Plaid "at no cost." When a customer revokes access, your server can receive a USER_PERMISSION_REVOKED webhook, so your site knows to stop relying on that connection.

How does your website stay up to date?#

Your website stays current through webhooks, which are messages Plaid sends to a URL on your server when something changes. You set the URL in the webhook field when you create a link token. Plaid's webhooks docs (opens in a new tab) say:

• Plaid sends a POST request with a JSON body.
• If your server does not answer with a 2xx code within 10 seconds, Plaid retries for up to 24 hours.
• Webhooks can arrive twice or out of order, so your handling must be safe to repeat.
• Verifying the webhook signature is optional but available.

Common examples include ITEM webhooks such as ERROR (the connection needs attention), PENDING_DISCONNECT (US and Canada, sent about 7 days before an Item disconnects) and USER_PERMISSION_REVOKED. When an Item breaks, for example because the customer changed their bank password, Plaid returns ITEM_LOGIN_REQUIRED, and you send the customer back through Link in "update mode" to fix it.

How do you test before going live?#

You test in Plaid's Sandbox, a free environment with fake banks and fake data. The Sandbox docs (opens in a new tab) say every Sandbox institution accepts the login user_good with the password pass_good. Sandbox also allows plain http redirect URLs for local testing, while Production requires https.

Plaid has two environments today: Sandbox and Production. The old Development environment was shut down on June 20, 2024. To test with real banks for free, new US and Canadian teams created on or after April 15, 2026 get a Trial plan with up to 10 live Items. When you are ready to launch, you request Production access in the Plaid Dashboard. For banks that use OAuth, Plaid also asks for a completed application profile and, for US and Canadian integrations, an approved security questionnaire, as described in the OAuth guide (opens in a new tab).

What do you need to run Plaid on a WordPress site?#

To run Plaid on WordPress you need four things: a Plaid account with API keys, an HTTPS site, server code that talks to Plaid, and somewhere safe to keep access tokens. In more detail:

1. A Plaid developer account. Your client_id stays the same, and you get one secret for Sandbox and one for Production.
2. HTTPS. Production redirect URIs must use HTTPS, and they must be added to the allowlist in the Plaid Dashboard.
3. Server-side code. Link tokens, token exchange and product calls all happen on your server, never in the browser.
4. Secure storage. Access tokens do not expire, so they need careful storage and a way to remove them.
5. A webhook endpoint. A URL that answers fast and handles repeats.

You can build all of that yourself, or use a plugin. BankBridge is a WordPress plugin that connects your site to Plaid and is built to work with WordPress, WooCommerce, Elementor, MemberPress and more. For the exact setup steps, check the BankBridge docs: Getting started, Plaid Link setup and Webhooks. For costs on the Plaid side, read Plaid pricing explained.

Common words you will see#

These are the Plaid terms that come up most often, in plain English.

Sources#

Checked October 23, 2026.

• Plaid documentation home (opens in a new tab)
• Plaid Link overview (opens in a new tab)
• Plaid Link for web (opens in a new tab)
• Plaid Link OAuth guide (opens in a new tab)
• Plaid Items API (opens in a new tab)
• Plaid webhooks (opens in a new tab)
• Plaid Sandbox (opens in a new tab)
• Plaid Auth (opens in a new tab)
• Plaid glossary (opens in a new tab)
• Plaid Transfer (opens in a new tab)
• Plaid changelog (opens in a new tab)
• Plaid billing models (opens in a new tab)
• How Plaid handles data (opens in a new tab)
• Plaid pricing (opens in a new tab)

Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.