Token endpoints

The /link/token/create endpoint creates a link_token, which is required as a parameter when initializing Link. Once Link has been initialized, it returns a public_token, which can then be exchanged for an access_token via /item/public_token/exchange as part of the main Link flow.
A link_token generated by /link/token/create is also used to initialize other Link flows, such as the update mode flow for tokens with expired credentials, or the Payment Initiation (Europe) flow.

1const request: LinkTokenCreateRequest = {
2  user: {
3    client_user_id: 'user-id',
4  },
5  client_name: 'Plaid Test App',
6  products: ['auth', 'transactions'],
7  country_codes: ['US'],
8  language: 'en',
9  webhook: 'https://sample-web-hook.com',
10  redirect_uri: 'https://domainname.com/oauth-page.html',
11  account_filters: {
12    depository: {
13      account_subtypes: ["checking", "savings"],
14    },
15  },
16};
17try {
18  const response = await plaidClient.linkTokenCreate(request);
19  const linkToken = response.data.link_token;
20} catch (error) {
21  // handle error
22}

The /link/token/get endpoint gets information about a previously-created link_token using the /link/token/create endpoint. It can be useful for debugging purposes.

1const request: LinkTokenGetRequest = {
2  link_token: linkToken,
3};
4try {
5  const response = await plaidClient.linkTokenGet(request);
6} catch (error) {
7  // handle error
8}

Exchange a Link public_token for an API access_token. Link hands off the public_token client-side via the onSuccess callback once a user has successfully created an Item. The public_token is ephemeral and expires after 30 minutes. An access_token does not expire, but can be revoked by calling /item/remove.
The response also includes an item_id that should be stored with the access_token. The item_id is used to identify an Item in a webhook. The item_id can also be retrieved by making an /item/get request.

1const request: ItemPublicTokenExchangeRequest = {
2  public_token: publicToken,
3};
4try {
5  const response = await plaidClient.itemPublicTokenExchange(request);
6  const accessToken = response.data.access_token;
7  const itemId = response.data.item_id;
8} catch (err) {
9  // handle error
10}

By default, the access_token associated with an Item does not expire and should be stored in a persistent, secure manner.
You can use the /item/access_token/invalidate endpoint to rotate the access_token associated with an Item. The endpoint returns a new access_token and immediately invalidates the previous access_token.

1// Generate a new access_token for an Item, invalidating the old one
2const request: ItemAccessTokenInvalidateRequest = {
3  access_token: accessToken,
4};
5try {
6  const response = await plaidClient.itemAccessTokenInvalidate(request);
7  // Store the new access_token in a persistent, secure datastore
8  const accessToken = response.data.new_access_token;
9} catch (error) {
10  // handle error
11}

Note: As of July 2020, the /item/public_token/create endpoint is deprecated. Instead, use /link/token/create with an access_token to create a Link token for use with update mode.
If you need your user to take action to restore or resolve an error associated with an Item, generate a public token with the /item/public_token/create endpoint and then initialize Link with that public_token.
A public_token is one-time use and expires after 30 minutes. You use a public_token to initialize Link in update mode for a particular Item. You can generate a public_token for an Item even if you did not use Link to create the Item originally.
The /item/public_token/create endpoint is not used to create your initial public_token. If you have not already received an access_token for a specific Item, use Link to obtain your public_token instead. See the Quickstart for more information.

1// This endpoint is deprecated and not
2// supported in the Beta libraries