Finance — entry 005 of 47

Banco do Brasil

Verified Aug 2026

Banco do Brasil's Portal Developers exposes the bank's own APIs — Pix instant payments, Cobrança (boleto/invoice billing and collections), and PJ account/statement data — behind OAuth 2.0 client credentials issued after registering an application with a CPF or CNPJ and promoting it through sandbox, homologação (staging), and production environments. Registration and the sandbox are free; production Cobrança/Pix usage carries Banco do Brasil's standard banking transaction fees rather than a separate per-call API charge, and going live requires an approved CNPJ-linked business account, so it isn't instantly self-serve for an individual developer. The developer portal still blocks bots, but this sandbox reached the real API gateway at api.bb.com.br directly. A GET request with an Origin header returned a 403 error from the bank's own system, not a bot page. An OPTIONS preflight request to the Pix endpoint returned 204. Neither response carried an Access-Control-Allow-Origin header, so `cors` resolves to `no`.

open-financebrazilpixbankingoauth
AuthenticationOAuthRequires an OAuth flow; expect app registration.
HTTPSSupportedTraffic is encrypted in transit.
CORSDisabledBrowser calls need a server-side proxy.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score71out of 100
Authentication8/25OAuth flow required
Pricing20/20Free to use
Docs14/20Documentation URL provided
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 71 on greatapis.com
<a href="https://greatapis.com/api/banco-do-brasil/"><img src="https://greatapis.com/badge/banco-do-brasil.svg" alt="Scored 71 on greatapis.com"></a>

Auth quickstart

  1. Register an app / run the OAuth flow to obtain a bearer token.
  2. Send it as an Authorization headerAuthorization: Bearer <token>
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.