Skip to main content
Developers

Authentication & credential lifecycle

Use workspace-scoped bearer API keys or OAuth 2.0 client credentials. Credentials identify an application; they do not create model, policy or transaction authority.

Overview Quickstart API reference Guides LQM Builder SDKs Auth & webhooks Changes Versioning CI Support Certification Programme Ecosystem Solutions References Evidence exchange Status Marketplace API plans

Choose an authentication mode

Both modes are bearer credentials and remain bound to one workspace, environment and explicit scope set.
Bearer API key

Best for server-to-server integrations that need a single long-lived application credential. Sandbox keys begin with fgpt_test_; production keys begin with fgpt_live_.

Authorization: Bearer $FINANCEGPT_API_KEY
OAuth 2.0 client credentials

Best for services that exchange a client ID and secret for short-lived access tokens. Requested scopes are intersected with the application and workspace entitlement.

POST /api/v2/oauth/token
grant_type=client_credentials
client_id=$FINANCEGPT_CLIENT_ID
client_secret=$FINANCEGPT_CLIENT_SECRET

Lifecycle rules

FinanceGPT keeps credential material one-way or encrypted and exposes secrets only at creation or rotation time.
Issue

Create the smallest scope set in sandbox first. The raw secret is shown once.

Use

Every API request is checked against application status, environment, entitlement, scope and rate limits.

Rotate

Rotation invalidates the previous credential immediately. OAuth secret rotation also revokes active access tokens.

Revoke

Revoke an application or an individual OAuth access token without changing unrelated workspace authority.

Authority boundary

A valid FinanceGPT credential proves application identity and carries API scopes. It does not approve or execute Financial Actions, promote LQMs, rebind QLMs, override workflow policy, or enable production access by itself.

Continue to webhooks & events →