Customer consent journey

Explore best practice and solutions to providing a consent journey for your customers

Link solution documentation

For further implementation details, refer to our full documentation for Link, our consent journey solution.

Authorization is a key part of any Codat solution - every companyCompany In Codat, a company represents your customer's business entity. Companies can have multiple connections to different data sources. must authorize your organization's access to their data before you can read or write that data. A frictionless and reassuring auth flow is essential for accessing your SMBSMB The primary customer segment that Codat helps businesses serve, typically companies with annual revenues under $500 million. customers' data.

To address this, Codat provides you with LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat., our consent and authorization journey solution. You can see the key steps of this journey on the diagram below. Its primary purpose is to streamline customer consent processes specifically related to sharing various data types, including accounting, banking, and commerce data. You will aim to create a modular framework that can be applied across different banking functions and user experiences, such as onboarding and loan applications.

Sample consent journey

We prepared a consent journey prototype using an example business insights dashboard use case.

View the protype in full screen →

Implementation options

Codat offers two options to implement the LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution in your application:

1. Use pre-built SDK

Codat has made it easy to deploy our LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution within your front-end user interface (UI) with our software development kit (SDK). The SDK is Codat's recommended option to implement a consent journey.

Our SDK is a pre-built JavaScript component that neatly sits in your front-end code that you can integrate and initialize it in any way you want, providing your customers with a native feel of your authorization journey. The component works with all major JavaScript frameworks, including React, and also with vanilla JavaScript. You can choose to implement the component in TypeScript.

Start your LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. build with the SDK →

2. Build with APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms.

Codat's LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution covers a series of APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. endpoints that you can use to fully embed the authentication journey within your digital application. These APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. endpoints can be called to create a customer within Codat’s instance and set up the connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. to the applicable integrations. With this option, your organization is fully responsible for building and owning the authorization user interface.

Review build-your-own requirements →

Build-your-own steps and endpoints

Review the key steps and endpoints involved in a build-your-own consent journey. These steps and corresponding endpoints are already considered and covered in our easy-to-use SDK.

No.	Action	Description
Onboarding:
1	Customer clicks on “Connect” button	Customer clicks on button within UI to initiate connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform.
2	Application triggers companyCompany In Codat, a company represents your customer's business entity. Companies can have multiple connections to different data sources. creation	Application places a call to LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s POST Create company endpoint to create a Codat companyCompany In Codat, a company represents your customer's business entity. Companies can have multiple connections to different data sources.
3	APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. responds with CompanyCompany In Codat, a company represents your customer's business entity. Companies can have multiple connections to different data sources. details	LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. endpoint responds with unique CompanyId to be stored and used by the application
4	Application triggers connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. creation	Application places a call to LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s POST Create connection endpoint to create a connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform.
5	APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. responds with ConnectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. details	LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. endpoint responds with linkURL to be shared with customer by the application
6	Customer authorizes access	Application directs user to the ‘linkURL’ where customer authenticates and authorizes access to data
7	Customer is redirected to application	Customer's consent journey finishes on a confirmation screen of the application
Ongoing management:
8	Customer wants to connect an additional package at a later date	Customer clicks on button within appication to connect an additional package. Application places a call to LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s POST Create connection with a companyId to create connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. and provide linkURL
9	Customer wants to disconnect an existing package	Customer clicks on a “Disconnect” button within appication. Application places a call to LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat.'s DELETE Delete connection

Ownership of delivery

Area	Description	Owner
UI	Front-end customer interaction UI	Client
Onboarding journey	Ability to connect accounting, banking and commerce software	Using LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. via SDK → Codat Using LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. via APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. → Client
ConnectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. management	Ability to add, disconnect, and manage connectionsConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform.	Using ConnectionsConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. SDK → Codat Using LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. via APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. → Client

Data access considerations

Security & data privacy and GDPR

In our agreement with you, Codat acts as the Processor of your customers' data while you remain its controller. This relationship allows you to maintain full control over your customers' data, including deciding when to delete that data. You should provide the customer with an overview of your Security and Data Privacy policies within your strategic consent journey.

Our customer our Help Hub provides customer-centric responses to security and data privacy concerns.

Ongoing connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. management

Your customer should have the ability to add, change, or delete existing connectionsConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. via a UI. Some software providers, such as Xero, even list this as a mandatory requirement. You can use Codat's Connections SDK, part of our LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution, in your UI to add additional integrations or delete existing integrations.

When deleting a connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform., it is critical that customers are aware of potential impact of rescinding that access. For example, if they are using multiple products you provide, all will be impacted.

Customer lifecycle

LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat., Codat’s authentication solution, is used at multiple stages of the customer lifecycle. We have covered some of the usage scenarios below.

1. Onboarding a customer for the first time

   If a customer hasn't granted access to integrations before, they will authenticate either through a specific product user journey or as part of a general new customer onboarding process.

2. Onboarding an existing customer onto a new product (multi-use case)

   Codat recommends that each customer grants access to all data during their first integration setup, but only relevant data will be read into Codat's cache based on the use case. This means Codat will initially only read relevant data for that first use case, but can later read data for other use cases without requiring the customer to re-authenticate.

   For example, a user might connect their Xero software via a Dashboard customer journey. They grant access to all data within their Xero account, but you initially only read data types that are relevant to the Dashboard product, because that is all the user has consented to.

3. An existing customer wants to add integration packages for an existing product

   Customers can use the the consent journey UI to make changes or add additional integration packages for a specific product, such as by clicking a “Click here to connect more packages" button.

4. A previously connected customer wants to grant data access for a specific product

   A customer has already connected their Xero account to a dashboard product and now wants to provide data for a lending use case. As they have previously granted access to all their Xero data, technically you already have access to read additional data types that you haven’t before.

   The customer will be presented with a screen that requires them to confirm they are happy to share additional datasets. This screen should contain a simple “Confirm I’m happy to share additional data” message and doesn't require the customer to re-auth or re-login to any accounting software. This consent should be stored and always adhered to with the ability to be revoked at any time.

5. An existing customer wants to remove consent for a specific use case

   Customers should have the option to revoke access to integrations through your product's user interface. It's important to inform customers about potential impacts when removing access, i.e. how it can impact other products.

   Consider also the data retention processes when a customer disconnects. If the customer has granted access for their data to be used in multiple products, keep in mind that access might still be needed for another product. Codat provides the capability to delete historical data via a specific endpoint.

6. An existing customer's Open Banking connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. has expired

   When an Open Banking connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. expires, it's important to communicate this to the customer. Provide them with an option to re-consent via the user journey within a specific product. Utilizing Codat APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms.'s connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. endpoints, you can re-initiate the login journey for the customer to re-consent.

Common questions

• What is the LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. process?

  The LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. process, supported by our LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution, is the authorization mechanism that allows your existing and prospective customers to securely share their financial data with you. This provides benefits for both the linking customer and you as the financial services provider.

• What is the first step in building a bespoke authentication flow using Codat?

  Your application should create a Codat companyCompany In Codat, a company represents your customer's business entity. Companies can have multiple connections to different data sources. to represent your customer when they sign up for your app. This allows you to track their connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. status from the beginning using POST Create company.

• How should users enter their third party credentials to authorize a connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform.?

  Your application should redirect the customer to the linkUrl found in the APIAPI A set of rules and protocols that allows different software applications to communicate with each other. Codat provides APIs for accessing financial data from accounting, banking, and commerce platforms. response after creating a data connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. for the selected integration. This is where they will enter their credentials.

• How does Codat secure the connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. with the underlying packages?

  Codat uses OAuth 2.0 to facilitate the consent and authentication process between Codat and each software integratoion. Our documentation contains details of our approach to Data security, and our Help Hub contains customer-centric responses to security concerns.

• How does the user log in?

  Each accounting software has a slightly different login and consent experience. In general, cloud-based packages require a username and password login once they user has been redirected. We provide detailed connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. instructions for every integration we support on our Help Hub.

• What happens when a customer connects?

  When a customer connects, Codat will start extracting and caching relevant data types. This process will likely take a few minutes but will depend on the amount of historical data being extracted.

• How does Codat highlight a completed syncSync The process of fetching the latest data from a connected data source. Syncs can be triggered manually or run automatically on a schedule.?

  Codat generates a webhook event once a data syncSync The process of fetching the latest data from a connected data source. Syncs can be triggered manually or run automatically on a schedule. has been completed. A webhookWebhook An automated notification sent from Codat to your application when specific events occur, such as when data syncs complete or connections change status. consumer can be set up to listen for read completion of specific data types or once all data types have synced.

• How can users manage their ongoing connectionsConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. and revoke access to platforms?

  As part of implementing our LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. solution, we recommend using the Connections SDK in your UI. The SDK fits perfectly with your LinkLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. deployment via our SDK and neatly linksLink The authorization flow that allows end users to connect their accounting, banking, or commerce platforms to your application via Codat. to Codat's underlying endpoints that support connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. management functionality. If you choose the build-your-own approach, ensure you build a connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. management UI that uses Codat's connectionConnection A link between a Codat company and a data source (like an accounting platform). Each connection represents authorized access to pull or push data from that platform. management endpoints.

• Our customers are likely to have questions about sharing their data. How can we address them?

  We address questions most commonly asked by our clients' customers on our Help Hub. You can share the customer-centric responses provided there directly with your clients or use them as a foundation to prepare your own.

  Some of the questions we hear most often include:

  • Will you have access to all my data?
  • Will my data be shared securely?
  • What if my accounting software isn’t listed?
  • Will you share my data with any third parties?
  • How do I revoke access to my data?