---
title: "Authentication"
description: "API authentication."
url: "https://developer-beta.morningstar.com/api-authentication"
image: "https://developer-beta.morningstar.com/_og/d/c_Ocean.takumi,title_Authentication,description_API+authentication.,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMwMDAwMDAifX19,p_Ii9hcGktYXV0aGVudGljYXRpb24i,s_KrB3p-jeMWJUFpAf.png"
---

-   [APIs](https://developer-beta.morningstar.com/apis)
-   [API Catalog](https://developer-beta.morningstar.com/api-catalog)
-   [API Assistant MCP Server](https://developer-beta.morningstar.com/api-assistant-mcp)
-   [Guides](https://developer-beta.morningstar.com/api-guides)
-   [Trial Access](https://developer-beta.morningstar.com/trial-access)

# Get Started

Understand how to get started with APIs.

# Authentication

[View Markdown](https://developer-beta.morningstar.com/api-authentication.md)[Download Markdown](https://developer-beta.morningstar.com/api-authentication.md)

Direct Web Services APIs use OAuth 2.0 to authenticate users. Before you can call any API endpoints, you must authenticate your account and get an access token.

## [Credentials](#credentials)

-   During onboarding, you must provide an email address that can be used as the username for your account.
-   Morningstar sends an email to the address provided containing instructions on how to create a password and activate the account credentials.

Important

The username and password are unique to your account and should always be securely stored and transmitted.

## [Access Tokens](#access-tokens)

-   Tokens are valid for 60 minutes and can be reused as many times as necessary during that time.
-   When a token expires, an error message is sent to trigger the creation of a new token.
-   Generated tokens are cached on Morningstar's server. If a new token is requested within ten minutes of the time the original token was generated, the same token will be returned. This is intended to reduce load on Morningstar's servers.
-   To refresh the token, send a new request.

## [Requesting an Access Token](#requesting-an-access-token)

Send a POST request to the token endpoint:

-   Endpoint: `/token/oauth`
-   Authentication method: Basic Authentication
-   Credentials: Base64-encoded `username:password`

```bash
curl --location \
--request POST 'https://www.us-api.morningstar.com/token/oauth' \
--header 'Authorization: Basic {Base64-encoded username and password}'
```

-   If the credentials are valid, an access token is returned.
-   If the credentials are invalid, an error response is returned.

## [Using an Access Token](#using-an-access-token)

Include the access token in the `Authorization` header when calling any Direct Web Services API.

```bash
curl --location \
--request POST 'https://www.emea-api.morningstar.com/direct-web-services/v1/screeners/market-data' \
--header 'Authorization: Bearer {access token}'
```

-   The API validates the token.
-   If valid, the request is authorized.
-   The requested data is returned to your application.