Why your bank asks you to sign in again when you connect an app

When you connect a budgeting app and the bank's own sign-in page appears, the bank is asking you, not the app, whether to share your data. The sign-in happens on the bank's page inside the connection window, the bank checks your credentials and your two-factor code itself, and what it hands back is a session for reading the accounts you selected, which the bank controls and can end. The app never sees the password. That is why the same sign-in returns months later when the bank expires the session, why changing your password breaks the connection, and why a sign-in request that arrives by email rather than from inside the app is the one to refuse.

The bank is the one granting access

An app cannot reach your accounts on its own. It asks a connection service, the service asks the bank, and the bank asks you. The sign-in is the bank's way of confirming that the person authorizing the connection is the account holder, and the consent screen after it is the bank's way of recording which accounts you agreed to share. Neither step can be skipped by the app, because neither step is the app's.

Some banks show their own sign-in page, opened inside the connection window, with the bank's address in it; others, without a page of their own for this, take the sign-in on the connection service's form for that bank. In both cases the credentials go to the bank or the service that holds the bank's session, and in neither case does the app receive them; see What Plaid is, and why your bank shows it for the service in the middle.

What the sign-in produces

1. You sign in on the bank's page, with the password and the two-factor code the bank asks for.
2. You choose the accounts to share, on the consent screen.
3. The bank issues a session to the connection service, scoped to reading those accounts, and records the grant in your connected-apps list.
4. The app receives data from that session: balances and transactions, daily, for as long as the session is valid.
5. The bank ends the session when you change your password, change two-factor settings, revoke the app, or when its own policy expires third-party access on a schedule, and the app asks you to sign in again.

A connection's life, as a timeline

The sign-in on day 91 is identical to the one on day 0, because the bank is doing the same thing: confirming it is you before issuing a new session. Nothing was lost in between; the data already synced stays, and the days missed fill in after the reconnect; see Why bank connections break, and how reconnecting works.

The sign-in to refuse

Because the bank's sign-in is a normal part of connecting, it is the shape that phishing copies: an email or a text saying a connection needs attention, with a link to a page that looks like the bank's. The real sign-in has two properties the fake one cannot have. It is opened from inside the app, by you, in the app's connection window, and the page it shows carries the bank's own address. A sign-in reached from a link in a message has neither, and the correct response is to close it and open the app instead. An app's real notice that a connection needs attention never asks you to sign in from the notice; it asks you to open the app.

Common mistakes

• Typing the bank password into the app itself. A connection asks for it on the bank's page in the connection window, never in the app's own form.
• Following a sign-in link from an email. The real sign-in is opened from inside the app.
• Reading a repeat sign-in as a fault. The bank expires sessions on its own schedule, and the reconnect is the same sign-in as the first.
• Connecting the bank a second time instead of reconnecting. That produces duplicate accounts; reconnect the existing connection.
• Declining the two-factor prompt. It is the bank's, and the session is not issued without it.

Common questions

Why do I have to log in to my bank to connect an app? Because the bank is the one granting the app access, and it confirms it is you before doing so. The sign-in happens on the bank's own page inside the connection window, and the bank issues the connection service a session for reading the accounts you selected; the app never receives the password.

Is it safe to enter my bank password when connecting? On the bank's own page inside the connection window opened from within the app, yes; that is where the bank expects it and the app cannot see it. On a page reached from an email or a text, no, whatever it looks like.

Why does my bank keep asking me to sign in again? Because it ends the session it granted: after a password change, a two-factor change, a revocation, or on a schedule its security policy sets, often around every ninety days. Reconnecting from inside the app repeats the same sign-in and issues a fresh session.

Does the app store my bank password? No. The password is entered on the bank's page, checked by the bank, and never handed to the app. What the app holds is data from a session the bank controls.

What is the difference between connecting and giving an app my login? Everything. Giving an app your login lets it do anything you can; connecting gives a service a read-only session the bank scopes and can end. A budgeting app that asks for your password in its own form, rather than opening the bank's page, is asking for the first.

How Zypper handles this

Zypper's connections go through Plaid, and the sign-in is the bank's: you sign in on your bank's own screen inside the secure Plaid window, pick which accounts to share, and Zypper receives read-only financial data, never your login; your bank credentials are never seen or stored by Zypper. When the bank ends the session, the connection shows as expired in the connections settings and stops syncing, your data is untouched, Zypper emails you, and the reconnect action in those settings opens the Plaid window again for the same sign-in, after which syncing resumes on the same accounts with the missed transactions backfilling. Reconnect from inside Zypper, never from a link. See Connecting your bank accounts, Fixing an expired or broken connection, and Privacy and security at Zypper for the details, or get started with Zypper to connect on your bank's own page.