Quick answer
An API (application programming interface) is a published set of rules that lets one software system ask another for data or actions in a fixed format. In open banking, approved apps use bank APIs to read data or start payments with your consent, holding a token instead of your password[1][2].
Key points
- API stands for application programming interface: rules for how two programs talk.
- Banking APIs let regulated apps read data or initiate payments with the customer's consent.
- Open banking APIs build on OAuth 2.0 access tokens, so the app never holds your password.
On this page
#What does API mean in simple words?
An API is like a menu in a restaurant. You cannot walk into the kitchen, but you can order anything on the menu, in the way the menu describes, and the waiter brings back exactly that. For software, the API is the menu: it lists what another program may ask for, how to ask, and what the answer will look like. In banking, the UK Open Banking standard describes its APIs as RESTful APIs that let third-party providers access information and initiate payments for customers, securely and with their consent[1].
#How does a banking API keep your password safe?
Open banking APIs build on OAuth 2.0, a standard that lets a third-party application obtain limited access to a service on behalf of the account owner[2]. You log in at your bank, approve a specific permission, and the bank gives the app an access token. In the UK standard that token is bound to one customer and one consent[3]. The full flow is explained in how banking APIs work, and the contrast with password sharing in screen scraping vs APIs.
Worked example
Example
A budgeting app wants your latest transactions. It sends a request to your bank's API at an address such as /aisp/accounts/1234/transactions (the UK standard's pattern) together with its access token[3]. The bank checks the token, sees that you approved read access to that account, and returns the transactions as JSON, a plain text data format. If the app asked for a payment instead, the token would not work, because you only approved reading.
#Are APIs only used in banking?
No. Weather apps, maps, online shops and social networks all use APIs. What makes banking APIs special is the extra security and regulation around them: financial-grade security profiles such as the OpenID Foundation's FAPI[4], and legal duties on banks to keep them available and secure. Open banking as a whole is explained in what is open banking and the short open banking entry.
Frequently asked questions
Is an API the same as an app?
No. An app is what you see on screen. An API has no screen; it is the doorway the app uses to talk to another system.
What is an API call?
One request sent to an API and the answer that comes back. UK open banking recorded 2.81 billion API calls in June 2026[5].
Sources
- Open Banking API specifications (latest version 4.0.1) — Open Banking Limited, 2026 Primary
- RFC 6749: The OAuth 2.0 Authorization Framework — Internet Engineering Task Force (RFC Editor), 2012 Primary
- Read/Write Data API Profile v4.0.1 — Open Banking Limited, 2026 Primary
- FAPI Working Group — OpenID Foundation, 2025 Primary
- Open Banking surpasses one billion payments and 100 billion API calls — Open Banking Limited, 2026 Primary
.jpg){kind=link}