USAA · Authentication Profile

Usaa Authentication

Authentication

USAA secures its APIs with oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

Financial-ServicesBankingInsuranceMilitary FinanceOpen BankingOpen FinanceFinancial Data ExchangeUnited StatesFortune 100

Methods: oauth2 Schemes: 2 OAuth flows: authorizationCode API key in:

Security Schemes

MemberPermissionedOAuth oauth2

scheme: authorizationCode

AggregatorApiKey apiKey

scheme: aggregator-managed

Source

Authentication Profile

generated: '2026-07-23'
method: searched
source: https://plaid.com/institutions/usaa/
docs: https://www.financialdataexchange.org/FDX/FDX/News/Spotlights/Member%20Spotlight%20USAA.aspx
note: >-
  USAA publishes no first-party OpenAPI, so this profile is captured from
  documented open-banking behavior rather than derived from a spec. Member
  financial data is reached only through consumer-permissioned aggregators
  (Plaid, Mastercard Open Banking, BankSync); each aggregator holds its own
  developer credentials, and the member-facing authorization to USAA follows the
  OAuth 2.0 / FDX tokenized pattern (no shared USAA username/password).
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  first_party_developer_credentials: false
  consumer_permissioned: true
schemes:
- name: MemberPermissionedOAuth
  type: oauth2
  scheme: authorizationCode
  description: >-
    Members grant scoped, tokenized access to an authorized third party via an
    OAuth 2.0 authorization flow; the third party receives a token, never USAA
    credentials. Aligned to the FDX API authorization model.
  sources: [docs]
- name: AggregatorApiKey
  type: apiKey
  scheme: aggregator-managed
  description: >-
    The developer-facing credential is issued and managed by the chosen
    aggregator (Plaid client_id/secret, Mastercard Open Banking, BankSync), not
    by USAA. USAA exposes no direct developer API key.
  sources: [docs]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/usaa-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.