Authentication

Create an access token and use it as a Bearer token.

Authentication

Financy uses OAuth2 client credentials. Before calling any API endpoint you
exchange your credentials for a short-lived access token.

Create a token

POST https://api.open-finance.ai/oauth/token

Field	Required	Description
`clientId`	✅	Identifies your company. Provided by Financy.
`clientSecret`	✅	Your secret. Keep it server-side — never expose it to the browser.
`userId`	✅	A stable identifier for the end-user, unique per user account in your system.

Request

curl -X POST https://api.open-finance.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret",
    "userId": "user-1234"
  }'

Response

{
  "accessToken": "eyJhbGciOiJ...",
  "tokenType": "Bearer",
  "expiresIn": 86400
}

Field	Description
`accessToken`	The token to send on every API request.
`tokenType`	Always `Bearer`.
`expiresIn`	The token's lifetime, as reported by the token endpoint.

Use the token

Send the token on every API request:

curl https://api.open-finance.ai/v2/payments \
  -H "Authorization: Bearer eyJhbGciOiJ..."

Handling expiry & errors

The token is per user (userId). Request a token for the specific user you
are acting on behalf of.
Cache it and reuse it while it is valid; request a fresh token as it nears
expiry.
If a request returns 401 Unauthorized, the token has expired or is
invalid — get a new one from POST /oauth/token and retry. See Errors for
the full list of status codes and the error response shape.

🔑
Your clientSecret is a server-side secret. Never ship it to a browser,
mobile app, or any client you don't control.

Updated 7 days ago

Did this page help you?