Authentication

Direct Web Services APIs use OAuth 2.0 to authenticate users. Before you can call any API endpoints, you must authenticate your account and get an access token.

Credentials

• During onboarding, you must provide an email address that can be used as the username for your account.
• Morningstar sends an email to the address provided containing instructions on how to create a password and activate the account credentials.

Access Tokens

• Tokens are valid for 60 minutes and can be reused as many times as necessary during that time.
• When a token expires, an error message is sent to trigger the creation of a new token.
• Generated tokens are cached on Morningstar's server. If a new token is requested within ten minutes of the time the original token was generated, the same token will be returned. This is intended to reduce load on Morningstar's servers.
• To refresh the token, send a new request.

Requesting an Access Token

Send a POST request to the token endpoint:

• Endpoint: /token/oauth
• Authentication method: Basic Authentication
• Credentials: Base64-encoded username:password

curl --location \
--request POST 'https://www.us-api.morningstar.com/token/oauth' \
--header 'Authorization: Basic {Base64-encoded username and password}'

• If the credentials are valid, an access token is returned.
• If the credentials are invalid, an error response is returned.

Using an Access Token

Include the access token in the Authorization header when calling any Direct Web Services API.

curl --location \
--request POST 'https://www.emea-api.morningstar.com/direct-web-services/v1/screeners/market-data' \
--header 'Authorization: Bearer {access token}'

• The API validates the token.
• If valid, the request is authorized.
• The requested data is returned to your application.