RealComposer
START FREE
Upstream APIsOfficial Plaid docs

Plaid Safe & Unsafe Practices

Direct Answer

Plaid client IDs, secrets, and item access tokens are server-only. Your server creates a short-lived link_token for Plaid Link, the client returns a public_token, and the server exchanges it for an access_token that is stored encrypted and never sent back to the app.

Credentials & Where They Belong

Client safe
link_token

Short-lived token created by your server to open Plaid Link.

Client safe
public_token

One-time token returned by Link. Expires quickly and must be exchanged server-side.

Server only
client_id and secret

Authenticate every Plaid API call.

Server only
access_token

Long-lived access to a user bank connection. Treat like a password.

Safe Practices

  • Exchange public tokens on the server

    Call /item/public_token/exchange from your backend and store the resulting access_token encrypted at rest.

  • Return only derived data to the app

    Send balances or a verified flag to the client, not raw account and routing numbers.

  • Verify Plaid webhooks

    Validate the Plaid-Verification JWT before acting on item or transaction webhooks.

Unsafe Practices

  • Storing access tokens in the mobile app

    Anyone who extracts the token can read the linked account until it is revoked.

  • Embedding client_id and secret in a client build

    This lets attackers create link tokens and exchange items under your account.

  • Logging full transaction or auth responses

    Account numbers and transaction history are sensitive financial data.

The RealComposer Pattern

Store PLAID_CLIENT_ID and PLAID_SECRET in the vault and run link token creation and data reads as edge pipelines. The app only ever handles link and public tokens, and the slimmer strips account numbers from responses.

START BUILDING FREE

Frequently Asked Questions

Q:Can I call Plaid directly from a React Native app?

Only Plaid Link runs in the app. Every API call that needs client_id, secret, or access_token must go through a server or edge proxy.

Plaid Recipes

All Plaid recipes (3)
Frontend / WebPlaid
Security & Secret Vault

Call Plaid API from Flutter without Exposing Client Secret

To solve call plaid api from flutter without exposing client secret, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe
Mobile App (iOS & Android)Plaid
Multi-API Aggregation

Merge Plaid Accounts and Transactions into Single Mobile Payload

To solve merge plaid accounts and transactions into single mobile payload, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

PII Redaction

PII redaction is removing or masking personally identifiable information, such as names, email addresses, phone numbers, and payment details, from data before it is exposed, logged, or shared. In APIs, redaction ensures clients and logs receive only the personal data they truly need.

Encryption at Rest

Encryption at rest is protecting stored data by encrypting it on disk or in a database, so it is unreadable without the decryption key. For secret vaults, each API key is encrypted with strong algorithms like AES-256-GCM and decrypted only at the moment it is needed.

Edge Secret Injection

Edge Secret Injection is a security pattern where sensitive upstream API credentials (e.g. Stripe Secret Keys, OpenAI Tokens) are stored in an encrypted vault and injected into HTTP request headers exclusively at the edge runtime, ensuring client browsers and mobile apps never see or store the keys.