Monzo connection
How Potzo connects to your Monzo account
Potzo's connection to Monzo works differently from its connection to your credit card. This page covers what that means and what it lets Potzo do.
Your credit card
Open Banking · Regulated · Read-only
Potzo
Matches & syncs
Your Monzo pot
Direct API · BYOK · Your key
Two connections, not one
Potzo uses two separate connections to do its job. Your credit card is connected via Open Banking - a UK-regulated standard. Your Monzo account is connected differently: through Monzo's own developer API, using a key that you generate and provide yourself. This is called the Bring Your Own Key (BYOK) model.
What is BYOK?
Rather than Potzo holding a shared or platform-level Monzo credential, you create a personal API key inside Monzo's own developer tools and give it to Potzo. This means the key belongs to you - not us. You can see it, rotate it, and delete it at any time directly from your Monzo account. Potzo has no access to your Monzo login, password, or PIN.
Monzo Developer Portal →What Potzo reads and does with your Monzo
Potzo reads your account ID to find the pots attached to your account. It reads your pots so it knows where to move money. Before each pot move, it reads your balance to make sure you have enough to cover the transaction and won't dip into your overdraft. When a pot move is made, Potzo reads only the transaction it just created - this is so we can add a description. Potzo never reads any transactions it hasn't created. Moving money into your designated pot is the only action Potzo takes, and it is only triggered by a matched credit card transaction.
What Potzo can't do with your Monzo
Potzo can't initiate external payments from your Monzo account, and it can't move money anywhere except the pot you chose. It doesn't read your Monzo transaction history beyond what it needs to find your account and pot, and it doesn't store anything else.
How your API key is stored
Your Monzo API key is encrypted at rest using AES-256. It is never logged, never transmitted in plain text, and is only decrypted in memory at the time a sync runs. Only you and Potzo have access to your key.
How to revoke access
To disconnect Potzo from Monzo, you can delete your API key directly from the Monzo app under Profile → Developer tools. The key becomes invalid immediately. You can also disconnect via Potzo's settings, which will delete the stored key from our systems.
Credit card connection
For information on how Potzo connects to your credit card via Open Banking, see the main security page.
Open Banking security →Questions? Email us at help@potzo.cc or join our Discord community.