Skip to main content

Authentication

Use the OAuth 2.0 client-credentials flow to authenticate your server-to-server integration. Portfolio Exchange supplies your client ID and client secret during onboarding.

1. Obtain an access token​

The token endpoint is https://{{AUTH_HOST}}/oauth2/token. Its authentication hostname can differ from the resource API hostname.

Send a form-encoded POST request with grant_type=client_credentials. Use Basic authentication with your client ID as the username and client secret as the password. Your HTTP library can construct the Authorization header for you.

The Get an access token reference includes request examples in each supported language, response fields and OAuth errors. In generated examples, {{BASE64_CLIENT_CREDENTIALS}} means the Base64 encoding of CLIENT_ID:CLIENT_SECRET using your onboarding credentials.

You can alternatively send client_id and client_secret in the form body using client_secret_post, with no Basic header. Use one client authentication method per request.

2. Call the API​

Use the returned access_token in the Authorization header on API requests:

Authorization: Bearer YOUR_ACCESS_TOKEN

The public API base URL is https://{{API_HOST}}. See Your first request for a market status example. Send token requests and API requests over HTTPS.

3. Reuse and renew the token​

Use expires_in to calculate when the token expires. Reuse the token until your application's renewal threshold, then request another token with the same client-credentials flow. This flow does not return a refresh token or an ID token.

Treat client secrets and access tokens as secrets. Keep them out of source control, browser storage, shared collections, documentation URLs and logs. The documentation does not accept credentials or submit live requests.

Authentication failures​

Token requests return OAuth errors such as invalid_client, described in the token reference. Resource API requests use the problem catalogue: 401 authentication-failed means authentication is absent or invalid, while 403 access-denied means the authenticated identity is not permitted to perform the operation.