A helpful thread from hn the other day on how auth tokens work and how companies like Plaid don’t actually store your credentials (like how mint did back in the day)
I don't know how Plaid handles that, but you don't have the nice, permission scoped, revokable tokens like you do with OAuth.
My primary bank has a checkbox for "third party access" and they pay out how you need to check it when you give a service your username and password so they can access your account. Same username and password, not a new one. It drives me insane how they don't offer OAuth.