Connecting a bank or brokerage to an app no longer means handing over your password. Here is what happens behind a read-only connection, and what it can and cannot do.
Key takeaways
- Modern connections use OAuth-style tokens, so the app never sees your password.
- Read-only access shows balances, holdings and transactions but cannot move money.
- Data coverage and refresh frequency vary by institution.
- Review and revoke connections periodically.
- Wealthnow is non-custodial and connects read-only; you approve every move.
From screen scraping to tokens
Early personal finance apps often asked for your bank username and password, then logged in as you to scrape balances. It worked, but it meant a third party stored your credentials and had the same access you did.
Modern connections increasingly use OAuth-style authorization. You sign in on your institution's own page, approve what the app may see, and the institution issues a token to the aggregator. The app never sees your password, and the token can be limited in scope and revoked.
Illustrative diagram.
What read-only means
A read-only connection lets an app see data such as balances, holdings, transactions and cost basis. It does not grant permission to move money or place trades.
That distinction is the foundation of how Wealthnow works. It reads your connected accounts to build one picture of your net worth and to find opportunities, but a read-only connection cannot act on them. Wealthnow finds and proposes; you approve every move.
What data is typically shared
Depending on the institution, an aggregator can usually provide account names and types, balances, positions with quantities and values, transaction history, and sometimes cost basis by lot. Coverage varies; some institutions share more detail than others, and some data updates daily rather than in real time.
It is worth reading the consent screen. It lists the categories of data you are sharing and with whom.
Read-only means Wealthnow can see your accounts, never move your money.
Staying in control
You can review and revoke connected apps, often from your institution's security settings and from the aggregator's own consumer portal. Removing a connection in the app itself should also stop future data refreshes.
A sensible habit is to audit connections once or twice a year and remove any you no longer use.
Questions to ask any app
Does it ever store my credentials? Is access read-only? Who is the aggregation provider? Can the app move money, and if so, under what approval? Is the app custodial, meaning does it hold my assets?
For Wealthnow the answers are: connections go through established aggregation providers and direct OAuth integrations, access is read-only, and Wealthnow is non-custodial. Your money stays at your brokerage.
Glossary
- Aggregator
- A service that connects to financial institutions and passes account data to apps you authorize.
- OAuth
- An authorization standard that lets you grant an app limited access without sharing your password.
- Non-custodial
- The app never holds your assets; they stay at your institution.
Frequently asked questions
Does Wealthnow see my bank password?
Connections go through aggregation providers and direct OAuth integrations, so you sign in with your institution and Wealthnow does not store your password.
Can a read-only connection place trades?
No. Read-only access is limited to viewing data.
How do I disconnect an account?
Remove it in the app and, if you like, revoke access in your institution's security settings or the aggregator's consumer portal.
Educational content, not investment, tax or legal advice. Wealthnow finds and proposes; you approve every move.
