[Bug]: Enable Banking with "imagin / CaixaBank" bank linking fails on desktop but works on mobile browser

What happened?

Version:

Client version: v26.6.0
Server version: v26.6.0

I was trying to link an imagin / CaixaBank account in Spain using the new Enable Banking bank sync integration in my self-hosted Actual Budget web application.

Expected: The Enable Banking authorization flow should work from desktop as well as mobile. On desktop, if the bank requires mobile app confirmation, the bank/Enable Banking flow should show an appropriate fallback such as a QR code or another way to continue authorization with the imagin mobile app.

Actual: The flow fails when I start it from the Actual web app on a desktop computer, but succeeds when I open the same self-hosted Actual Budget URL on my mobile phone and start the linking process there.

On mobile, the flow successfully triggers my imagin bank application and I can approve the authorization.

On desktop, after confirming Enable Banking data-sharing consent, the flow redirects into imagin/CaixaBank/Redsys, but eventually lands on an imagin error page:

Ups
Parece que alguien ha desenchufado el cable que no tocaba

Translated:

Oops
It looks like someone unplugged the wrong cable.

The failed desktop redirect ends up on a URL under:

https://www.imagin.com/ser-imaginer

The redirect chain also contains an app-link style CaixaBank/imagin URL similar to:

https://imaginbank.plink.pro.caixabank.es/psd/registro

This looks like the bank authorization is being routed into a mobile/app-link style CaixaBank/imagin path, but on desktop it does not show a usable fallback and does not return to Actual’s callback URL.

Important additional context: I previously linked imagin directly through Enable Banking outside Actual, from a desktop computer using its API directly with Postman, and Enable Banking/the bank handled the desktop flow by showing a QR code to scan with the imagin mobile app. So imagin + Enable Banking can work from desktop, but Actual’s current flow appears to trigger a different/broken path.

This suggests the issue may be related to how Actual opens the Enable Banking authorization URL on desktop.

A likely culprit is that Actual currently opens the authorization URL using a constrained popup:

window.open(
  authUrl,
  'enablebanking-auth',
  'width=600,height=700,popup=yes',
);

For imagin/CaixaBank, this popup behavior may be causing the bank authorization frontend to choose the wrong app-link/mobile fallback instead of the desktop QR-code flow.

Desktop computer:

How can we reproduce the issue?

1. Use Actual Budget web UI on a desktop computer.
2. Configure Enable Banking bank sync in production mode.
3. Start the process to add/link a bank account.
4. Select provider:

• Country: Spain
• Bank: imagin

1. Continue to the bank authorization step.
2. Observe that Actual/Enable Banking opens the authorization flow in a popup-sized browser window.
3. The flow redirects through imagin/CaixaBank/Redsys authorization URLs.
4. Instead of completing authorization and returning to Actual’s /enablebanking/auth_callback, the desktop flow lands on an imagin error page:

Ups
Parece que alguien ha desenchufado el cable que no tocaba

Translated:

Oops
It looks like someone unplugged the wrong cable.

1. Repeat the same linking process from Actual’s web UI on a mobile browser. 10 Expected: desktop and mobile should both complete the Enable Banking authorization.
2. Actual: mobile completes successfully, desktop fails.

Additional context

The Enable Banking event sequence seen before the failure is:

confirm_data_sharing_consent
get_session_status?current_uri=https://tilisy.enablebanking.com/ais/
start_authorization
get_session_status?current_uri=https://tilisy.enablebanking.com/ais/
leaving

This suggests that the flow reaches the bank handoff successfully. The failure appears to happen after leaving Enable Banking, during the imagin/CaixaBank/Redsys authorization step.

A working standalone Enable Banking script uses:

{
  "redirect_url": "https://enablebanking.com/"
}

and instructs the user to open the returned authorization URL manually in a normal browser tab. That flow works for the same imagin provider.

Actual instead uses its own callback URL:

https://<actual-domain>/enablebanking/auth_callback

and opens the authorization URL in a fixed-size popup.

The most likely Actual-side issue is the popup behavior rather than provider selection, because the flow reaches the imagin/CaixaBank authorization URL.

Suggested fix / thing to test

Change the Enable Banking authorization window from a constrained popup to a normal browser tab/window.

Current behavior:

window.open(
  authUrl,
  'enablebanking-auth',
  'width=600,height=700,popup=yes',
);

Suggested test:

const authWindow = window.open(authUrl, '_blank');

if (!authWindow) {
  return {
    error: 'unknown' as const,
    message: t('Could not open Enable Banking authorization. Please allow popups and try again.'),
  };
}

This would make Actual behave closer to the plain Enable Banking flow that works for imagin/CaixaBank on desktop.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Chrome

Operating System

Windows 11