verapli
Sign inJoin free
Menu

Guides · payments · Popular APIs

Revolut Business API

Revolut Business account on the Grow plan or above, an uploaded X509 certificate, a signed client assertion JWT and in-app consent to get access and refresh tokens.

Researched · not yet run liveLast researched 25 October 2026 · Revolut · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

The Business API acts on one Revolut Business account. Only the account owner can open the API settings and register certificates.

  • Revolut Business account organisation owned by the businessMust be on the Grow plan or above for API access.
  • Account Owner personal owned by the person · under Revolut Business accountHas full access and is the only role that can open the API settings.
  • Revolut Business sandbox account developeroptional owned by the personSeparate test environment with mock data.

Each business may hold only one Revolut Business account (EEA terms).

There is no public API for personal Revolut accounts.

Have ready

  • A registered company or sole trader with a valid registration number: Charities, political or religious organisations, trusts, SPVs, foundations and non-profits may be refused (EEA terms).
  • Grow plan or above: API access is included in Grow, Scale and Enterprise.
  • OpenSSL (or similar) on your machine: Used to generate the private key and public certificate.
  • An HTTPS redirect URI you control: Revolut redirects there after you consent; its domain is also the JWT iss claim.
  • Business registration details as recorded in your local business register · Business accounts can only be opened by companies or sole traders registered with a valid registration number. [5]Needed for: Open a Revolut Business account
  • ID for the person opening the account and possibly directors and owners [to verify exact list] · The person opening the account must give Revolut all the information it needs during account opening. [5]Needed for: Open a Revolut Business account
  • A way to pay for the Grow plan or above [2]Needed for: Move to the Grow plan or above
  • A domain you control for the OAuth redirect URI · The JWT iss claim is the redirect URI domain without https://. [3]Needed for: Generate a key pair and upload the public certificate, Create the client assertion JWT

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Open a Revolut Business account

    You apply for the account yourself and provide everything Revolut asks for during account opening. Revolut may decline due to legal, regulatory or risk reasons.

    • Guided by hand
    • Human step: You press submit

    Where: https://business.revolut.com/

  2. Wait for business verification

    Revolut reviews the business and the people behind it before the account is usable. [to verify typical time]

    • Guided by hand
    • Human step: The provider reviews it
    • After: Open a Revolut Business account

  3. Move to the Grow plan or above

    API access needs Grow, Scale or Enterprise. You choose and pay for the plan yourself.

    • Guided by hand
    • Human step: You add payment details
    • After: Wait for business verification

  4. Create a sandbox account (optional)optional

    Use Revolut's separate sandbox with mock data to try the API first. Generate and upload a certificate there as well.

    • Guided by hand
    • Human step: You sign in

  5. Generate a key pair and upload the public certificate

    Generate a private key and X509 public certificate with OpenSSL on your machine. As account owner, open Settings (gear icon), APIs, Business API, add an API certificate, paste the whole certificate including the BEGIN and END lines, and enter your OAuth redirect URI. Keep the private key on your machine.

    • Guided by hand
    • Human step: You press submit
    • After: Move to the Grow plan or above

    verapli captures REVOLUT_CLIENT_ID here by plain code: encrypted in your browser, never shown to AI.

    Where: https://business.revolut.com/

  6. Create the client assertion JWT

    Sign a JWT with RS256 using your private key: iss is your redirect URI domain without https://, sub is the client ID, aud is https://revolut.com, exp is a number of seconds (not a string).

    • Official API
    • After: Generate a key pair and upload the public certificate

  7. Exchange the code for tokens

    Exchange the authorisation code, with the JWT, for an access token and a refresh token. The access token lasts 40 minutes; use the refresh token and JWT to get a new one from /api/1.0/auth/token.

    • Official API
    • After: Create the client assertion JWT, Consent to the application

    verapli captures REVOLUT_REFRESH_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Refresh fails after the JWT has expired: Generate a new client assertion JWT with the same private key and retry. [3]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Prohibited business activities

Prohibited activities include adult entertainment, dating and escort services, cannabinoids, weapons, trading in antiques, precious metals, stones or art, auction houses and pawnbrokers, counterfeit goods, chemicals, video-game arcades, debt collection, binary options or gambling, certain financial services, embassy services, holding client funds and pension schemes, crowdfunding platforms, streaming companies, and anything Revolut sees as quasi-cash or outside its risk appetite. [5]

Can cost moneyThe rules say

Services may be restricted after opening

Even after opening an account, Revolut may restrict services outside its risk appetite, for example some cryptocurrency activity. [5]

Can cost moneyThe rules say

Business use only, one account

The account is for business purposes only, and each company or sole trader may hold only one Revolut Business account, including after a closure. [5]

Can cost moneyThe rules say

API key only if your plan allows

Revolut gives an API key only if you ask and your plan allows it. API keys count as security details you must keep safe. [5]

Can cost moneyThe rules say

Virtual-card fraud liability

Revolut excludes liability for fraud that results from not using card-level controls when generating virtual cards via the Business API. Store card details securely if you keep them. [5]

Worth knowingThe rules say

Owner-only setup

Only the account owner can open the Business API settings. [1]

What you end up with

Env varSecretFormatWhat it is
REVOLUT_CLIENT_IDnot secretClient ID shown after the certificate is added
REVOLUT_PRIVATE_KEY_PATHnot secretPath to the private key that signs the client assertion JWT (the key itself stays on your machine)
REVOLUT_REFRESH_TOKENsecretRefresh token used to get new 40-minute access tokens

Pricing

  • Costs: API access is included in the Grow, Scale and Enterprise plans; transaction fees, exchange rates and limits may apply.
  • Plan prices vary by country and were not captured. [to verify]

Source [2]

For agents

The same entry as JSON: /api/v1/entries/revolut/business-api · requirements /api/v1/requirements/revolut/business-api · terms /api/v1/terms/revolut/business-api.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Revolut Business API, and how long will it take?"
  → tools/call requirements { "provider_id": "revolut/business-api" }

Sources

  1. Revolut Business – Business API API available to customers on the Grow plan and above; account owner accesses it in Settings; no public API for personal accounts · accessed 25 October 2026 · official
  2. Revolut Help – Revolut Business API Needs an active Revolut Business account and a Grow plan or above; usage fees may apply; a sandbox account can be used instead · accessed 25 October 2026 · official
  3. Revolut Developers – Make your first API request Certificate generated with OpenSSL and uploaded under Settings, APIs, Business API with an OAuth redirect URI; client assertion JWT (RS256, iss = redirect URI domain, sub = client_id, aud = https://revolut.com); consent in the app gives an authorisation code exchanged for tokens; access token lasts 40 minutes and a refresh token is issued. Read through search-engine extracts only (page blocks automated fetches). · accessed 25 October 2026 · official
  4. Revolut Developers – Set up a test environment with Revolut Sandbox Sandbox is a separate environment with mock data; certificate must be generated and uploaded there too. Read through search-engine extracts only. · accessed 25 October 2026 · official
  5. Revolut Business Terms (Revolut Bank UAB, updated 22 December 2025) Eligibility (registered companies or sole traders; excluded entity types), prohibited business activities, one Business account per business, API key only if your plan allows, security of API keys, liability exclusions including virtual-card fraud without card controls · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Revolut is not affiliated with verapli.