White-label & platformOpen Banking as a ServiceDemo data

Open banking under your own brand — with the keys, limits and webhooks to run it.

Banks, MFIs, fintechs and marketplaces ship open banking as their own product — Open Banking as a Service. Your name, logo and colours appear on the consent flow your customers see, and you run the platform from one dashboard: preview a look in the sandbox before you save it, issue API keys with their own rate limits, read usage analytics and receive signed webhooks with durable delivery.

Try the live demoRead the docsGet sandbox keys

Sandbox only: mock banks and synthetic data. No real money moves.

Previewing your brand on one Link session

http
POST /v1/link/token/create          // Silkroute-Client-Id / Silkroute-Secret
{ "user_ref": "user_42",
  "branding": {                     // sandbox only: brands this session
    "display_name": "NovaPay",
    "primary_color": "#7C3AED", "accent_color": "#0B0F19",
    "logo_url": "https://cdn.novapay.uz/logo.svg",
    "consent_headline": "Connect your bank to NovaPay" } }
→ { "link_token": "link-sandbox-3f9a…" }

POST /v1/link/branding              // the widget, with its link_token
{ "link_token": "link-sandbox-3f9a…" }
→ { "branding": { "display_name": "NovaPay",
      "logo_url": "https://cdn.novapay.uz/logo.svg",
      "primary_color": "#7C3AED", "on_primary_color": "#FFFFFF",
      "accent_color": "#0B0F19",
      "consent_headline": "Connect your bank to NovaPay",
      "secured_by": "Silkroute", "source": "preview" } }

How it works

  1. 01

    Brand the consent flow

    An owner, admin or developer opens the Branding page in the dashboard and saves, once per organisation, a display_name, two colours, a logo and your support and privacy links. Every Link session then shows your brand — and “Secured by Silkroute” always stays visible.

  2. 02

    Preview before you save

    Press “Preview in Link” in the dashboard, or send a branding object on /v1/link/token/create with a sandbox key, and see a look on a single session. Nothing is saved, and production sessions use only the branding you saved.

  3. 03

    Issue keys, set limits

    Create sandbox and production API keys in the dashboard; each secret is shown exactly once. Give every key its own rate limit (1–100000 requests a minute, 600 by default), rotate it when needed and revoke it when you are done.

  4. 04

    Watch it run

    Usage analytics show requests per day, error rate and p50 / p95 latency per endpoint, and request logs filter by key. Signed webhooks keep your systems in sync, and every platform change lands in the audit log.

What you get

✓Your brand in consent

display_name, primary_color and accent_color, logo_url, support_url, privacy_url and a consent_headline — saved per organisation. on_primary_color, the text colour on your primary colour, is picked by WCAG contrast so it stays readable.

✓Validated inputs

A name is 1–40 characters with no markup, colours are #RRGGBB, links are https only, up to 500 characters and free of credentials, and a headline fits in 120. Anything else is rejected with INVALID_BRANDING.

✓Live previews

A sandbox-only branding object on /v1/link/token/create brands just that one session; a non-sandbox key gets 400 SANDBOX_ONLY. The dashboard’s “Preview in Link” does the same without saving anything.

✓API keys

Created in the dashboard, with only a hash of the secret stored. Rotate a key (the old secret stops immediately) or revoke it. Sandbox and production environments — production keys can be created, but stay inert in this sandbox build (403 PRODUCTION_NOT_ENABLED).

✓Rate limits and analytics

Per-key limits (default 600 a minute); X-RateLimit-Limit and X-RateLimit-Remaining on every response; over the limit you get 429 RATE_LIMIT_EXCEEDED with Retry-After. Analytics show requests per day, error rate and p50 / p95 latency per endpoint, plus requests and throttles per key.

✓Durable webhooks

Webhook endpoints per organisation and 10 event types. Delivery is durable with exponential backoff — 2^n minutes, capped at 6 h, then dead. Enable or disable endpoints, redeliver and send a test event from the dashboard.

🛡 Consent & security

  • ●Tenant isolation: every query is scoped to your organisation, so one tenant’s branding, keys, request logs and webhooks are never visible to another.
  • ●API secrets and tokens are stored only as peppered SHA-256 hashes; a secret is shown exactly once and cannot be read back.
  • ●Every webhook is signed — Silkroute-Signature: sha256=<HMAC-SHA256 of the raw body with your webhook secret> — and verifyWebhook in the SDK checks it for you.
  • ●Every platform change lands in the audit log: key created, rotated or revoked, limit changed, branding updated, webhook enabled, disabled or redelivered.
Try it in TelegramFull API reference

More products

🔁

Variable Recurring Payments

Approve once, then pay variable bills within per-payment and monthly limits. Pause or revoke anytime.

🪪

Credit Passport

Consented cash-flow data with explained factors that licensed lenders may use. The borrower sees every access and can revoke it.

⚖️

Auto-Balancing

Rules that top up an account before a payment fails — suggest-and-confirm or fully automatic, with caps and a donor floor.

🏦

Treasury & Split Payments

One view of all company balances across banks, and a single payment split over several accounts — with reserves, roles and safe partial-failure handling.