Autosync for P2P platforms
Today your investors download a file and upload it to P2P Dash by hand. With a read-only token and one endpoint on your side, their transactions arrive on their own. No passwords, no OAuth. 2,100+ investors track their portfolios on P2P Dash.
What it changes
Autosync isn't live yet. No platform offers this today, so this is what we'd build together.
Their numbers stay current
Right now they log in, find the export, download it and upload it again every time they want fresh numbers. With Autosync they paste a token once. Their return, interest and cash then update without another file.
One less hurdle for people who track you
Nobody has to look for the export or ask your support how it works. Your platform gets the Autosync label on its P2P Dash page and in the platform list. Regular imports also keep the community figures on your page current, because they come from imported transactions.
How it works
The investor sets it up once. After that, it runs without them.
The investor creates a token
In their account settings on your platform, behind your normal login. You show the token once.
They paste it into P2P Dash
One field on your platform's entry in their P2P Dash account. That's the whole setup.
P2P Dash fetches the transactions
Server to server, about once a day. We read recent days again to pick up late bookings.
The investor stays in control
They revoke the token on your side or disconnect on ours. Either way the fetching stops.
What you'd build
We kept this as small as we could, because you have other things to do. Your transaction export is a good place to start for the data.
What you need
- A settings page where an investor creates and revokes a read-only token. Show it once, store only a hash.
- One GET endpoint that returns that investor's transactions for a date range
- A rate limit per token. We call about once a day, so a low limit is fine.
- A short note on what your transaction labels mean. An email is enough.
What you don't need
- OAuth, redirects or consent screens
- Webhooks or background jobs on your side
- A developer portal or sandbox
- Loan, borrower or personal data in the response
You know your codebase better than we do, so we won't guess how many days this takes. If you want to go through it with your developers first, send us your questions.
The endpoint
This is a suggestion, not a fixed format. If your system makes something else easier, tell us. CSV or Excel with the same fields works too.
Request
GET /v1/transactions?from=2026-10-01&to=2026-10-31
Host: api.yourplatform.com
Authorization: Bearer <token>Response
{
"transactions": [
{
"date": "2026-10-02",
"type": "deposit",
"amount": 500.00,
"currency": "EUR"
},
{
"date": "2026-10-15",
"type": "interest",
"amount": 12.34,
"currency": "EUR"
}
]
}Fields
date- ISO 8601, in UTC or with an offset. A timestamp is fine too, we only use the day.
type- Your own labels are fine, we map them. If you're starting from scratch, you can use our names below.
amount- A number with a dot as decimal mark. Positive, with the direction given by the type. A reversal is a negative amount of the same type.
currency- ISO 4217 code, so EUR for euros.
Good to know
- Both date parameters are optional. Without them, return the full history. That's what the first sync uses.
- No pagination needed. If a response would get too big, tell us your limit and we'll ask in smaller date ranges.
- Respond with 401 for an invalid or revoked token, and with 429 and a Retry-After header when the rate limit is hit.
How we name transaction types
These are the exact names we use internally. You don't have to copy them, they're just here as inspiration. The closer your types are to these, the less we have to translate.
deposit- Money moved into the platform from outside.
withdrawal- Money moved out of the platform, back to the investor's bank.
investment- Money put into a loan or project, including secondary market purchases.
interest- Interest earned on an investment.
principalRepayment- Invested capital coming back from a loan or project.
bonus- Cashback, referral, campaign and other rewards.
fee- Anything the platform charges the investor.
tax- Tax paid or withheld.
defaultLoss- Capital lost when a loan defaults and can't be recovered.
internalTransfer- Money moving between accounts inside the platform. It doesn't change the balance.
This list may grow, for example with types for the secondary market. If your platform already has more types, send them as they are. For now we map them to the names above, but that can change later.
Four things that have to be right
The format can bend. These can't, because the return we calculate depends on them.
Every money movement
Deposits, withdrawals, investments, interest, principal repayments, bonuses, fees, taxes and default losses. Without deposits and withdrawals we can't calculate a return, and without investments and repayments we can't show invested capital.
Complete days
A date range returns every transaction on those days. We compare and keep whole days, which is also why you don't need transaction IDs.
Reachable by a server
The token is the only thing this endpoint asks for. No CAPTCHA, no bot challenge, no session cookie, no 2FA prompt. If your site sits behind Cloudflare or similar, the path needs an exception.
Changes announced
Tell us before labels or fields change, or use a versioned path. A new label we don't know shows up as an unrecognised transaction until we've added it.
What the token can and can't do
This is what your security people will ask about, so here it is in one place.
Read-only, one investor
It reads the transactions of the investor who created it. It can't log in, invest, withdraw or change anything.
No personal data
The response holds date, type, amount and currency. No name, no address, no IBAN, no borrower.
Revocable at any time
The investor deletes it in your settings. The next call gets a 401, we stop and tell them the connection ended.
How we'd handle it
Encrypted in our database, used only on our servers in Frankfurt, deleted on disconnect or account deletion. We store daily totals per type, not your rows, same as for an uploaded file today.
The Autosync label
Platforms that offer this get a label on P2P Dash. It says one thing about you: how your data gets to us.
What the label means
- Investors can connect this platform with a token instead of uploading files
- It shows on your platform page and as a filter in the platform list
- It's free, with the same conditions for every platform
What it doesn't mean
- It's no quality seal and no recommendation
- It doesn't change rankings, scores or what we write about you
- It can't be bought, and it doesn't need an affiliate deal
P2P Dash is free and earns through affiliate links. Those don't change any numbers either. How that works is on our transparency page: p2pdash.com/transparency/
Questions you might have
If yours isn't here, ask. You'll get an answer from the person who builds this.
Is Autosync live?
Not yet. We build our side once a first platform commits, and we'd do it together with that platform. Manual imports stay available for everyone either way.
Why not OAuth?
OAuth means an authorization server, consent screens and client management on your side. For read-only access to someone's own transactions, a token the investor creates gets the same result with much less work.
What if a token leaks?
Whoever has it can read that investor's transaction history until the token is revoked. That's a real risk, and it's why the token can only read, the response holds no personal data, and revoking takes one click. An expiry date on your side is fine too, we'd ask the investor for a new token.
Is this only for P2P Dash?
No. The token belongs to the investor, so they could give it to any tool they choose. You'd build one endpoint, not a special integration for us.
What does it cost?
Nothing, in either direction. We don't charge for Autosync and you can't pay for the label.
Is it OK under data protection rules?
The investor decides to share their own data and creates the token themselves. We can't give you legal advice, so your legal team should have a look. We're happy to answer their questions, and our privacy policy will describe the fetching before it goes live.
Which currencies can you handle?
Send the currency with every transaction. P2P Dash has one account currency per platform and doesn't convert, so tell us if your investors hold several currencies in one account and we'll work out how to handle it.
Want to be the first?
Write to Tim, who builds P2P Dash. A short “we could do this” or a list of questions from your developers is plenty to start.
Email tim@newnow.deWe read every email personally and usually reply within a few days.