You wanted it? Here it is.

I have recently started using Mint.com for my personal finances. At first, I was very skeptical about the security of things at mint. I was unsure whether or not I could trust the connection and my personal banking information to be accessed by another person and/or company. In short, after reviewing their security policy and taking a closer look, I was able to move past my insecurities.

With ease, I have been able to connect all of my banking information in just a few simple clicks… Pretty scary, huh? I think this is an amazing feature for banking 2.0 sites. Mint.com takes care of organizing your finances through an easy-to-use interface. All this is great but, as a developer, my mind started thinking about how I can make use of this site. And so, the task of investigating whether or not mint.com has an official API to pull transactions, account balances, and other things of the like. It would be great if I could integrate mint.com support into different applications and backend’s that I write.

After a couple hours of perusing through the Internet’s web of data, I was able to find a large amount of user requests for exactly this sort of thing. Seems like I’m not the only one to have had this idea, nothing new here… While there are definitely pro’s and con’s of having an API to access account information, I think that this feature would prove very beneficial to the site. There are a multitude of things I could use mint.com API support for. Anyways, without deviating from my original point… Wait, what’s that? … You guessed it! I began to play with the idea of creating a high-level PHP class to support scraping mint.com for user information.

Within around an hour or so, I was able to automate the mint.com login and scrape all of my accounts, including:

• Account Name
• Time last checked
• Account Balance
• Account Nickname

It was actually rather easy to do. It’s a simple case of using PHP and cURL to fetch the information you need. It looks a little something like this:

$url = 'https://wwws.mint.com/loginUserSubmit.xevent';
$post = array(
	'username' => $username,
	'password' => $password,
	'task' => 'L'
);

//build the query _GET string
$post = http_build_query($post);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 12);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');

//get the results now
$result = curl_exec($ch);
$error = curl_error($ch);
curl_close($ch);

That bit of code sets up a cURL object that contains all of the appropriate settings/POST information that it needs to log into the mint.com site. This cURL request requires a cookie jar to store the result of the mint.com login script(s). After you have the result, you can actually begin scraping out the individual accounts by exploding on the text “</a></h4><h6><span>” and filtering through each match to make sure that you can pull the information that you want.

Now that we’ve generally covered the scraping process, you can take it another level by performing things like:

• Retrieving account transactions
• Performing a refresh account request
• Getting account alerts
• Pulling budget information
• Getting mint.com charts
• And all of the other great stuff Mint.com has to offer…

In the hour I had to experiment with this idea, I was able to toy with the idea of performing a “Refresh Account” request. This request, along with the others i just mentioned in the list above, require a little more work. I still have not perfected the request due to lack of time. But from what it looks like, mint.com initiates a server-side request to refresh all accounts attached to the current user. A token is passed to the refresh script as another layer of security. After reviewing the source of the overview page, it looks like the token can be directly pulled from the html, so you would need to simply extrapolate this data in order to perform tasks. I have tested this by just posting the extracted token to the url, along with the original cookie jar, and I receive a response: “Session has expired.” This makes me believe that mint.com is expecting information from cookies that have been generated client-side. The next step is to basically pull the data that is generated client-side and post it to the url above, along with the token and the cookie jar. The token can be found in a hidden input with the id “javascript-user”. I think the naming convention confirms my thought process about client-side cookie generation. I will need more time to look into this further and have plans to post my findings when I get to them.

The reason the refresh is so important is because of the slow HTTPS connection that occurs when you log in with cURL and PHP. To speed this up, we could auto-cache a first result of the accounts and their balances, much like what mint.com does. After the accounts have been cached, we can pull the data from MySQL almost instantly and then give an “Update All” button to the user just like mint.com. This would help us achieve faster page load speeds as we won’t be waiting for a 10 second script to finish loading dynamically.

I say all of this to mention that getting mint.com account data isn’t all that bad… However, I’d prefer an official REST API or something of this sort.