Supported Banks¶

Nineteen Israeli financial institutions are supported — major banks and credit cards.

#	Institution	Config key	Login fields	2FA / OTP
1	Bank Hapoalim	`hapoalim`	userCode, password	optional
2	Bank Leumi	`leumi`	username, password	optional
3	Discount Bank	`discount`	id, password, num	optional
4	Mizrahi Tefahot	`mizrahi`	username, password	optional
5	Mercantile	`mercantile`	id, password, num	optional
6	Otsar Hahayal	`otsarHahayal`	username, password	optional
7	Beinleumi	`beinleumi`	username, password	optional
8	Massad	`massad`	username, password	optional
9	Yahav	`yahav`	username, nationalID, password	optional
10	Beyahad Bishvilha	`beyahadBishvilha`	id, password	optional
11	Behatsdaa	`behatsdaa`	id, password	optional
12	Pagi	`pagi`	username, password	optional
13	One Zero	`oneZero`	email, password, phoneNumber	required
14	Visa Cal	`visaCal`	username, password	optional
15	Max (Leumi Card)	`max`	username, password, id	optional
16	Isracard	`isracard`	id, card6Digits, password	optional
17	Amex	`amex`	id, card6Digits, password	optional
18	PayBox (by Discount Bank)	`paybox`	phoneNumber	required
19	Pepper (by Bank Leumi)	`pepper`	phoneNumber, password	required

Use the Config key as the bank name in your config.json.

Common fields (any bank)¶

Every bank entry shares the same shape on top of its credentials:

"<bankKey>": {
  "<...credentials...>": "...",
  "daysBack": 14,                  // or "startDate": "2026-02-01"
  "targets": [
    { "actualAccountId": "uuid", "reconcile": true, "accounts": "all" }
  ],
  "timeout": 30000,                // optional, raise for slow networks
  "twoFactorAuth": false,          // optional
  "twoFactorTimeout": 300          // optional, seconds
}

Full reference: Bank options.

2FA / OTP¶

Any bank with an SMS verification screen supports twoFactorAuth: true. The Telegram bot prompts for the code. For automated handling, see OTP auto-forward.

OneZero, PayBox, and Pepper are API-direct banks — 2FA is required on every login, but after the first SMS login the importer saves what keeps the login and sends it on later logins, so they skip the SMS: a long-term token for OneZero and PayBox, and the enrolled device's state for Pepper. Keep twoFactorAuth: true; see Long-term token and Pepper.

Security tips¶

Mount config.json read-only in Docker (:ro).
chmod 600 config.json outside the container.
Encrypt your config when storing it on disk.
Use the split credentials.json + config.json pattern so settings stay shareable.