Plaid WordPress Plugin: How to Add Plaid Link

A Plaid WordPress plugin lets visitors connect a bank account on your site through Plaid Link, then lets your server use that connection for payments, verification or financial data. The pattern is always the same: your server creates a short-lived link_token, the browser opens Link, and your server swaps the resulting public_token for a permanent access_token. This guide explains each step, what WordPress has to do, and the settings that most often break a launch.

What does a Plaid WordPress plugin actually do?#

It connects three things: the Plaid API, the Plaid Link screen your visitors see, and the WordPress features you already use, such as checkout, memberships or forms. Plaid's docs (opens in a new tab) describe Link as "Plaid's client-side component" that "helps your users connect their accounts." Everything else, from account numbers to balances, is fetched by your server after the user finishes Link.

A plugin's job on WordPress is to:

1. Store your Plaid client_id and secret safely on the server.
2. Create a link_token when a visitor starts a bank connection.
3. Load Link in the browser and handle its callbacks.
4. Exchange the public_token and store the access_token securely.
5. Call the Plaid products you need, such as Auth or Balance.
6. Receive Plaid webhooks so your site knows when an Item needs attention.
7. Hand results to the right WordPress feature, for example a WooCommerce order or a membership signup.

How does the Plaid Link flow work on a WordPress site?#

The Link flow is a four-step handshake between your server, the visitor's browser and Plaid. Plaid's Link overview (opens in a new tab) lays it out like this.

Token lifetimes matter when you design the page:

• link_token: expires after 4 hours, or after 30 minutes when it was created for an existing Item in update mode (Link docs (opens in a new tab)).
• public_token: "ephemeral and expires after 30 minutes" (Items API (opens in a new tab)).
• access_token: does not expire. Plaid says it "should be stored in a persistent, secure manner" and can be revoked with /item/remove.

On WordPress, steps 1 and 4 belong in server code, such as a REST API route or an admin AJAX handler, because they need your secret. Steps 2 and 3 run in JavaScript on the page.

What do you need from Plaid before you start?#

You need a Plaid Dashboard account, your API keys and a plan for testing. Plaid's Quickstart (opens in a new tab) points to the Keys page at dashboard.plaid.com/developers/keys. There are two kinds of value:

Plaid now has two environments, Sandbox and Production. Its changelog (opens in a new tab) records that the old Development environment was decommissioned on June 20, 2024. Sandbox is free, and every Sandbox institution accepts user_good / pass_good as the test login (Sandbox docs (opens in a new tab)).

For testing with real accounts, Plaid's billing docs (opens in a new tab) describe a Trial plan for US and Canada teams created on or after April 15, 2026. It allows free use with real Production data, limited to 10 Production Items, and removing Items does not free up slots.

How do you load Plaid Link on a WordPress page?#

You load Plaid's script from Plaid's CDN and start Link with the link_token your server created. The Link web docs (opens in a new tab) give the script URL:

<script src="https://cdn.plaid.com/link/v2/stable/link-initialize.js"></script>

Plaid says not to self-host or bundle this script. It must load from cdn.plaid.com, and because the SDK is unversioned the CDN always serves the latest version. On WordPress, that means enqueueing the script by URL rather than copying it into your theme or plugin.

Plaid.create takes these options:

• token: the link_token for this session.
• onSuccess(public_token, metadata): runs when the user links an Item. metadata includes the institution, the selected accounts (with id, name, mask, type, subtype) and a link_session_id.
• onExit(error, metadata): runs when the user leaves without linking, or when an error happens. The error has error_type, error_code, error_message and a user-facing display_message.
• onEvent(eventName, metadata): runs at points in the flow. Plaid notes ordering is not guaranteed.
• onLoad: runs once Link has loaded.
• receivedRedirectUri: used to resume Link after an OAuth bank redirect.

Content Security Policy on WordPress#

If your site or a security plugin sends a Content Security Policy header, Link needs room to work. Per the Link web docs (opens in a new tab):

• default-src and frame-src must allow https://cdn.plaid.com/.
• script-src must allow the Link script URL, with 'unsafe-inline' or a nonce.
• style-src rules need 'unsafe-inline' or a nonce, depending on your policy.
• connect-src must allow https://production.plaid.com/, or https://sandbox.plaid.com in Sandbox.

A blocked script here is a common reason Link "does nothing" when the button is clicked.

How do you set the OAuth redirect URI?#

You add a page on your site to the "Allowed redirect URIs" list in the Plaid Dashboard and pass the same URL as redirect_uri when you create the link_token. Plaid's OAuth guide (opens in a new tab) says OAuth is required for US, EU and UK integrations that connect to financial institutions, which "includes many of the largest banks in the US."

Rules from the OAuth guide that affect WordPress sites:

1. HTTPS only. Redirect URIs must use HTTPS. Sandbox allows http://localhost for testing.
2. No hash routing. The URI cannot contain a #.
3. No query string in redirect_uri. Do not add query parameters to the value you send to /link/token/create.
4. No wildcard in the request. Wildcards are allowed only in the Dashboard allowlist, and only for domains you control.
5. Resume with the same token. When the bank sends the user back, reopen Link with receivedRedirectUri set to the full URL received, and reuse the original link_token. Plaid says this is required for webviews and recommended for mobile web; desktop web does not require it.

If the redirect page is not on the allowlist, /link/token/create returns INVALID_FIELD. Plaid's fix is to add the URI to the Dashboard list.

Production OAuth also has account steps. The OAuth guide lists Production access, completing registration in the Dashboard compliance center, filling in application display information, and, for US and Canada, the latest Master Services Agreement and an approved security questionnaire.

Where should WordPress store Plaid tokens?#

Store the access_token only on the server, in a place that is not public and not sent to the browser. Plaid's Items API (opens in a new tab) says the token does not expire and "should be stored in a persistent, secure manner." Practical rules for WordPress:

• Never print the access_token or your secret into page HTML, JavaScript or logs.
• Link the stored token to the WordPress user or order it belongs to.
• Call /item/remove when a user disconnects or you offboard them. It invalidates the access_token and any processor tokens tied to it.
• If you think a token leaked, /item/access_token/invalidate returns a new token and kills the old one.

For more on what to store and what to avoid, see BankBridge data handling and security.

Which Plaid webhooks does a WordPress site need?#

At minimum, a WordPress site should listen for Item webhooks so it can react when a bank connection breaks. You set the webhook URL through the webhook field of /link/token/create (Webhooks docs (opens in a new tab)). Useful Item webhooks from the Items API (opens in a new tab):

Webhook rules that matter on shared hosting:

• Plaid retries a non-2xx response, or no response within 10 seconds, for up to 24 hours.
• Webhooks can arrive twice or out of order, so make your handler idempotent.
• Keep the handler light. Save the payload and process it later so you answer in time.
• Verification is optional but recommended. Plaid signs webhooks with a JWT in the Plaid-Verification header using ES256, and you should reject any webhook older than 5 minutes (verification docs (opens in a new tab)).

Which Plaid products fit common WordPress sites?#

The right product depends on what the site needs to do with the bank account. Descriptions below come from Plaid's product overview (opens in a new tab).

For a fuller map, see Plaid products and WordPress use cases.

Should you build it yourself or use a plugin?#

Build it yourself if you have a PHP developer who will own the integration long term; use a plugin if you want the pattern above already wired into WordPress. A custom build has to cover token handling, CSP, OAuth redirects, webhooks, update mode and error handling, plus testing each time WordPress, WooCommerce or Plaid changes.

Whichever route you pick, your business holds the Plaid account and pays Plaid's fees directly. Plaid bills Production traffic only, and Sandbox is free (billing docs (opens in a new tab)).

Where BankBridge fits#

BankBridge is a WordPress plugin that connects your site to Plaid. It is built to work with WordPress, WooCommerce, Elementor, MemberPress and more. You bring your own Plaid keys. For the exact settings, start with Getting started, then Connect your Plaid keys and Plaid Link setup. Every license comes with a year of updates and support and a 14-day refund window, and checkout is handled securely by Stripe.

What should you check before going live?#

Check your hosting, your Plaid account status and your error handling before real users connect banks. A short list:

1. HTTPS everywhere. WordPress recommends HTTPS support (requirements (opens in a new tab)), and Plaid requires HTTPS for Production redirect URIs.
2. Modern PHP. WordPress recommends PHP 8.3 or greater, with MySQL 8.0 or MariaDB 10.11 or greater.
3. Production secret in place. INVALID_API_KEYS usually means the keys do not match the environment you are calling.
4. Redirect URI allowlisted in the Plaid Dashboard.
5. Webhook URL reachable from the internet with a valid SSL certificate.
6. Update mode ready for ITEM_LOGIN_REQUIRED.
7. Plaid approvals done, including OAuth registration for the banks your users need.

The going live checklist and troubleshooting guide cover these in more detail.

Sources#

Checked October 23, 2026.

• Plaid Docs: Link overview (opens in a new tab)
• Plaid Docs: Link web SDK (opens in a new tab)
• Plaid Docs: OAuth guide (opens in a new tab)
• Plaid Docs: Items API (opens in a new tab)
• Plaid Docs: Webhooks (opens in a new tab)
• Plaid Docs: Webhook verification (opens in a new tab)
• Plaid Docs: Quickstart (opens in a new tab)
• Plaid Docs: Sandbox (opens in a new tab)
• Plaid Docs: Billing (opens in a new tab)
• Plaid Docs: product overview (opens in a new tab)
• Plaid Docs: changelog (opens in a new tab)
• WordPress requirements (opens in a new tab)

Plaid is a trademark of Plaid Inc. BankBridge is an independent plugin and is not affiliated with or endorsed by Plaid.