Skip to content
WallynWallyn Docs

Security and confirmation

Authentication

Section titled “Authentication”
  • You sign in with your Wallyn account and approve access on a consent screen (OAuth 2.1 with PKCE).
  • The MCP server validates every token (signature, issuer, audience and expiry) before talking to the API. A missing, invalid or expired token gets 401, so the client can renew the sign-in.
  • The API validates and authorizes everything again and isolates data per account. The MCP server does not access the database.

Scope of access

Section titled “Scope of access”

The authorization covers the financial data of your account. There are no partial levels: that is why every deletion and reversal requires your explicit confirmation in the conversation.

Deleting and reversing always ask for confirmation

Section titled “Deleting and reversing always ask for confirmation”

Deleting, removing, undoing or reversing changes balances and cannot be undone. So every tool of this kind (marked * in Tools):

  1. Carries destructiveHint, so the client knows it is destructive.
  2. Requires the confirm: true parameter.
  3. Without confirm: true, it does not call the API. It returns the effect on the balance and asks the assistant to check with you.

Example: when you say “Delete the last entry”, the assistant explains the effect on the balance and only deletes after you confirm.

What Wallyn does not do

Section titled “What Wallyn does not do”
  • It does not move real money. create_transfer, pay_card_invoice and pay_transaction only record movements in your tracker. A request like “send João R$ 100 by Pix” will be declined.
  • It does not connect to your bank.
  • It does not read the assistant’s memory, history or files.

Data accessed

Section titled “Data accessed”

Name, email and your account’s financial data (accounts, cards, entries, budgets, goals), plus members and invites. No health data.

Disconnect and delete your account

Section titled “Disconnect and delete your account”

Remove the connector in your assistant whenever you want: after that it can no longer call Wallyn. You can also delete your account from Profile, inside the app, which always asks for confirmation.

Privacy

Section titled “Privacy”

The data processed is described in the Privacy Policy (section 4) and the Terms of Use (section 6).

Support

Section titled “Support”

Questions or trouble connecting: atendimento@wallyn.com.br.