Skip to main content
Core Platform

Issue an OAuth 2.0 client-credentials service token

POST /oauth/token

Contract

Authentication
No global bearer requirement
Required scope
Operation-specific / public
Status
Published

Request body

application/x-www-form-urlencoded ยท required
{
    "grant_type": "client_credentials",
    "client_id": "string",
    "client_secret": "string",
    "scope": "string"
}

Code examples

These examples compose a request only. Public reference pages never transmit your credential or execute the operation.

curl

curl -X POST \
  -H "Authorization: Bearer $FINANCEGPT_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  --data '{
    "grant_type": "client_credentials",
    "client_id": "string",
    "client_secret": "string",
    "scope": "string"
}' \
  "https://financegpt.dev/api/v2/oauth/token"

javascript

const response = await fetch("https:\/\/financegpt.dev\/api\/v2\/oauth\/token", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${FINANCEGPT_API_KEY}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "grant_type": "client_credentials",
    "client_id": "string",
    "client_secret": "string",
    "scope": "string"
}),
});
const data = await response.json();

python

import json
import os
import requests

response = requests.request(
    'POST',
    'https://financegpt.dev/api/v2/oauth/token',
    headers={
        'Authorization': 'Bearer ' + os.environ['FINANCEGPT_API_KEY'],
        'Accept': 'application/json',
    },
    json=json.loads('{"grant_type":"client_credentials","client_id":"string","client_secret":"string","scope":"string"}'),
)
response.raise_for_status()
print(response.json())

php

<?php
$ch = curl_init('https://financegpt.dev/api/v2/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer '.getenv('FINANCEGPT_API_KEY'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(array (
  'grant_type' => 'client_credentials',
  'client_id' => 'string',
  'client_secret' => 'string',
  'scope' => 'string',
)),
]);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Responses

Status Description
200 Access token issued
400 Invalid grant or scope
401 Invalid client
403 API entitlement unavailable

Authority boundary

A developer credential proves application identity and permits only its scopes. It does not grant model promotion, policy override, QLM rebinding, or Financial Actions execution authority unless those separate controls are satisfied.

Machine-readable sources