This question is one we're still answering with banks. The exact security model will likely differ slightly by bank, depending on their idiosyncratic wishes and

This question is one we're still answering with banks. The exact security model will likely differ slightly by bank, depending on their idiosyncratic wishes and standards. Also, the security model could be broken down in to (a) How do we talk to the banks (b) How is our system secured and (c) How do end-developers talk to our systems. For the last one, which is what I think you're asking, it seems like our bank partners will settle on (1) a long, random, high-entropy API secret key (like Stripe) or SID/auth token combo (like Twilio) or (2) Both the secret key AND something like OAuth because banks really want multi-factor authorization. But again, nothing is set yet.