What it takes to connect Revolut Business to your accounts package

Revolut publishes a Business API that will list your accounts and return your transactions. It is properly documented, it is free to use, and it does not require a third-party aggregator sitting between you and your own money.

It is not on every plan. API access is included on Grow, Scale and Enterprise. It is not included on the Basic plan, which is the free one, and there is no add-on that changes that.

A business on Basic cannot be connected to anything through the Business API, by us or by anybody else, and no amount of engineering gets around it. If you are reading this because you want a bank feed, the first thing to check is which plan you are on. The app shows it, and it decides whether the rest of this page applies to you at all.

Revolut does not give you a simple access key (an API key). Instead, you upload a security certificate, then approve the connection in the Revolut Business app (an OAuth consent).

You generate a key pair on your own machine and upload the public certificate in the Business app, under APIs, Business API. Revolut gives you back a Client ID. Your software then uses the private key to sign a short proof of identity (a client assertion JWT). You approve the software inside the Revolut Business app. That approval produces a code (an authorisation code), which your software swaps for an access token at Revolut's token endpoint.

Doing this requires specific permissions on your Revolut account: Manage Integrations and Manage API under API and Integrations, and View Business under Billing. If you are not the owner of the account, somebody who is will need to grant those before you start.

The private key never leaves the machine that made it, and the certificate you upload is a public one. That keeps the connection in your hands. It can be limited to reading, and you can cancel (revoke) the certificate in your own settings at any time. Whoever built the integration cannot stop you.

A Revolut Business connection has three parts, each with its own lifetime, and each needs handling on its own.

The access token lasts forty minutes. Revolut's documentation says so in words, and gives it as 2399 seconds (expires_in). Software that keeps using a token for longer than that will fail from time to time.

The refresh token does not expire. Revolut's documentation says so explicitly.

The certificate is the one with a real deadline. The command in Revolut's own guide creates it with a validity of 1825 days, which is five years. Write the expiry date down on the day the certificate is created.

Reading transactions is the first half.

The value is in what happens after the read. Transactions matched against the invoices they settle, so the money that landed sits beside the money that was billed. Categories that follow the chart of accounts your bookkeeper already uses. And receipts matched to the lines they belong to.

Done properly, the only lines a person ever looks at are the ones no rule could place. Keeping that list short is the whole point.

Amounts should be stored as whole numbers in the smallest unit, so 18.34 euro is stored as 1834 cent. They become a decimal only once, when they are shown on a screen. The reason is that the usual way computers store decimals (binary floating point) cannot hold most decimal fractions exactly. In JavaScript, 1.005 multiplied by 100 gives 100.49999999999999. The obvious way of converting a decimal amount to cents then rounds it down and loses a cent.

A bank statement is correct to the cent, so a cent lost on a transaction shows up as a difference in the reconciliation.

Nothing above is specific to Revolut except the front door. Any bank that exposes a business or open banking API can be connected, and the matching, the categorisation and the reconciliation behind it are the same work whichever bank it is. Revolut is the one written so far.

Where it stands: the integration is written and the design is settled, and no client is running it yet. Revolut puts the API on Grow and above, and the businesses we work with today are on Basic, so there has been nothing to connect it to.

That means the first build is done at cost and to a date agreed in writing.