Live data from Hacker News

Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

realizefi.com

11–20 of 97 posts

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#11

Congrats on launching. I'm not familiar with the space so forgive me but when you say we "build direct integrations", what does that mean? Is the data available by APIs or did you get someone to do something custom for you? If it's available by API, why would others screenscrape?

Thanks! Where possible, we integrate with brokerages' public APIs (we refer to these as "sanctioned integrations"). Brokerages like TD and Alpaca implement OAuth such that we can get delegated access to user accounts, but that's not the case for other brokerages (ex: Robinhood, Webull, etc.). In the latter case, we'll reverse engineer brokerage APIs, which we refer to as "direct integrations" since they use the same…

Hmmm also ignorant on this, but is that legal? I’d assume it’s a TOS violation at least.

Would using this cause accounts to be banned in these direct integrations?

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#12
> We take an entirely different approach by building direct integrations...

> Private APIs need to be reverse engineered and are liable to change at any moment, so we had to develop systems to catch breaking changes and are always on alert to address them.

Isn't this still, essentially, screen-scraping? Reverse-engineering private APIs (presumably from their mobile apps, I'd imagine) and doing the abuse/block dance with their protective systems?

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#13

Earlier quoted context omitted.

Thanks! Where possible, we integrate with brokerages' public APIs (we refer to these as "sanctioned integrations"). Brokerages like TD and Alpaca implement OAuth such that we can get delegated access to user accounts, but that's not the case for other brokerages (ex: Robinhood, Webull, etc.). In the latter case, we'll reverse engineer brokerage APIs, which we refer to as "direct integrations" since they use the same…

Hmmm also ignorant on this, but is that legal? I’d assume it’s a TOS violation at least. Would using this cause accounts to be banned in these direct integrations?

Different brokerages take different positions on these sorts of integrations - some go after all third-party integrations aggressively (including screen scrapers), while some will turn a blind eye as long as you're not abusing their platform. For a brokerage like Robinhood, we've only seen them take enforcement actions against individuals if they send a high volume of orders in a short timeframe.

It's worth noting that even with sanctioned integrations (such as the one we developed for TD Ameritrade), sending too many orders at once or not appropriately batching orders will still get you in trouble - we guide people that integrate with us through these nuances so that their users don't get angry calls from risk departments :).

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#14

> We take an entirely different approach by building direct integrations... > Private APIs need to be reverse engineered and are liable to change at any moment, so we had to develop systems to catch breaking changes and are always on alert to address them. Isn't this still, essentially, screen-scraping? Reverse-engineering private APIs (presumably from their mobile apps, I'd imagine) and doing the abuse/block dance w…

Who is liable if the user's brokerage account gets blocked?

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#15

As a consumer, I’ve had significant difficulty getting my Schwab Equity Award Center balances to sync with apps like Wealthfront. The connection is always buggy and I have to reauthenticate all the time. I wonder if this is the problem. If so, I’m glad you are working on this. Best of luck!

When a consumer logs in with our application we save their access/refresh tokens. We can use these keys to keep a long lived session such that an app using our API should never have to re-auth their users again. The only instance where a session may need to re-auth is if their password gets changed, or some equivalent account modification such that the long lived refresh tokens expire. We specifically chose to integrate with institutions with refreshable tokens directly in order to maintain secure non-buggy connections.

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#16

> We take an entirely different approach by building direct integrations... > Private APIs need to be reverse engineered and are liable to change at any moment, so we had to develop systems to catch breaking changes and are always on alert to address them. Isn't this still, essentially, screen-scraping? Reverse-engineering private APIs (presumably from their mobile apps, I'd imagine) and doing the abuse/block dance w…

While we try to form relationships with all of the brokerages we integrate with (including the ones we reverse engineer), we do still have to do the abuse/block dance with their protective systems occasionally. We've found that cutting out headless browsers has made it much easier to do this, for two main reasons:

1) Some brokerages have fairly sophisticated anti-screen-scraping protections, but their private APIs are comparatively undefended. 2) It's generally more difficult to create protective systems for private APIs, since there are fewer ways to fingerprint non-browser clients.

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#17

> We take an entirely different approach by building direct integrations... > Private APIs need to be reverse engineered and are liable to change at any moment, so we had to develop systems to catch breaking changes and are always on alert to address them. Isn't this still, essentially, screen-scraping? Reverse-engineering private APIs (presumably from their mobile apps, I'd imagine) and doing the abuse/block dance w…

While we try to form relationships with all of the brokerages we integrate with (including the ones we reverse engineer), we do still have to do the abuse/block dance with their protective systems occasionally. We've found that cutting out headless browsers has made it much easier to do this, for two main reasons: 1) Some brokerages have fairly sophisticated anti-screen-scraping protections, but their private APIs ar…

I think "direct integrations" as a euphemism from "using reverse-engineered private APIs in violation of their terms" is dishonest.

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#18

> We take an entirely different approach by building direct integrations... > Private APIs need to be reverse engineered and are liable to change at any moment, so we had to develop systems to catch breaking changes and are always on alert to address them. Isn't this still, essentially, screen-scraping? Reverse-engineering private APIs (presumably from their mobile apps, I'd imagine) and doing the abuse/block dance w…

This sounds like backwards to how this industry should be evolving...

Re: Launch HN: Realize (YC W22) – Integrate brokerage accounts into your site or app

#19

Earlier quoted context omitted.

While we try to form relationships with all of the brokerages we integrate with (including the ones we reverse engineer), we do still have to do the abuse/block dance with their protective systems occasionally. We've found that cutting out headless browsers has made it much easier to do this, for two main reasons: 1) Some brokerages have fairly sophisticated anti-screen-scraping protections, but their private APIs ar…

I think "direct integrations" as a euphemism from "using reverse-engineered private APIs in violation of their terms" is dishonest.

That's a fair point - we've been trying to determine the best way to compress "using reverse-engineered private APIs in violation of their terms, but in practice brokerages don't really take enforcement actions against this," and "direct integrations" is what we came up with. We'll work on finding a better way to express this and are open to suggestions.
Post reply on HN