Banking and payments
The engine reads bank statements, Revolut Business accounts and Stripe balances into a knowledge base, for cash, finance and reconciliation agents.
Content is read in place, in your deployment, in your own account. LightHouse receives ids, hashes and counts only. The transactions are not transmitted, and LightHouse does not open the credential.
Read-only, always
Section titled “Read-only, always”These connectors only read, and read and write is refused: connect them as Read. Where the provider states a key’s permissions, a key that can withdraw, transfer, sign, trade or approve payments is refused as write_capable, naming the permission, and nothing is read with it. Where it does not, the key is unverified until you confirm it only reads.
Connect in LightHouse
Section titled “Connect in LightHouse”You need the Client administrator (client_admin) role, signed in as a person, and a deployment whose engine reads this connector (compatibility reference) and keeps credentials in your own store.
- Make the credential at the provider, as the section below describes.
- Go to Setup and admin → Connectors, find the provider (search for it, or filter by family), and choose Connect.
- Name the fields listed, and leave the access level at Read.
- Paste the credential. Your browser seals it to your deployment; LightHouse never sees it.
- Your deployment keeps it and checks it. The card shows the result.
What the health codes mean
Section titled “What the health codes mean”| Code | The card says | What to do |
|---|---|---|
write_capable |
The key can withdraw, transfer, sign or trade: refused, nothing is read | Make a view-only key at the provider, pin it to your deployment’s egress addresses, and connect it again |
unverified |
The provider does not state the key’s permissions and it was not confirmed view-only | Check that it only reads, then connect it again with View-only confirmed set to yes |
auth_failed |
The provider refused it | It may have expired or been revoked. Make a new one and connect it again |
Bank statements
Section titled “Bank statements”- Reads: camt.053, camt.052, MT940 and MT950 statements from any bank, and MT535 statements of holdings from any custodian, from your SFTP drop. A statement file cannot move money, trade, instruct or approve, so there is no permission to check.
- Paste: two lines: the server’s host key fingerprint (
SHA256:...), then the PEM of the drop account’s private key. The host key is pinned. - Name: SFTP drop, where your bank or custodian delivers the files.
- A drop in a bucket is read by your deployment’s own role, set up by your engineer.
Revolut Business
Section titled “Revolut Business”- Reads: accounts, balances, transactions, counterparties, expenses, FX rates and cards (never card numbers).
- Make: your own Business API certificate. Upload its public key in Revolut Business (Settings, APIs) and consent with the READ scope only.
- Paste: the client ID, then the one-off authorisation code (or a refresh token), then the PEM of the certificate’s private key.
- Name: Redirect domain (the domain you gave Revolut with the certificate), What you paste second, Environment (production or sandbox) and View-only confirmed.
- Where Revolut states the consent’s scope,
WRITE,PAYandREAD_SENSITIVE_CARD_DATAare refused, named. If Revolut ends the consent, connect again.
Stripe
Section titled “Stripe”- Reads: your balance and every balance transaction.
- Make: a restricted key (
rk_) with Read on Balance only, restricted to your deployment’s addresses. A secret key (sk_) is refused: it can move money. - Paste: the restricted key.
- Name: View-only confirmed; Stripe does not state a restricted key’s permissions.
Where the credential is held
Section titled “Where the credential is held”LightHouse never opens these credentials. They are sealed in your browser, or by lighthouse-ai connect <provider> --credential-stdin, to your deployment’s own key, and your deployment keeps them in your own secrets store. LightHouse keeps the connection’s fingerprint, the access level, when it was checked and the check’s code: never the credential, and never what it reads. See Where every credential is held.
Removing it
Section titled “Removing it”On the card, choose Disconnect. Your deployment deletes the credential from your store. Revoke it at the provider too. Documents already written stay in the corpus until you delete them.