---
title: "Generate a JSON Web Token (JWT)"
url: "https://developer-beta.morningstar.com/apis/investment-details-feed-api/versions/bc1f8f4b-464c-40a5-af50-a06cce9f3980/operations/createToken"
---

> Full API specification: https://developer-beta.morningstar.com/apis/investment-details-feed-api/versions/bc1f8f4b-464c-40a5-af50-a06cce9f3980.md

# Generate a JSON Web Token (JWT)

`POST` `/token/oauth`

Operation ID: `createToken`

Exchanges your Client ID and Client Secret for a signed JWT bearer token. Send your credentials as a Base64-encoded `clientId:clientSecret` string in the `Authorization` header. Use the returned `access_token` as a `Bearer` token on all other endpoints in this API.

## Responses

- `200` - 200: OK
- `401` - 401: Unauthorized

## OpenAPI definition

```yaml
openapi: 3.1.0
info:
  title: Investment Details Feed API
  version: "1.0"
servers:
  - url: https://www.us-api.morningstar.com
    description: Americas
  - url: https://www.apac-api.morningstar.com
    description: APAC
  - url: https://www.emea-api.morningstar.com
    description: EMEA
paths:
  /token/oauth:
    post:
      tags:
        - Authentication
      summary: Generate a JSON Web Token (JWT)
      description: >-
        Exchanges your Client ID and Client Secret for a signed JWT bearer
        token.


        Send your credentials as a Base64-encoded `clientId:clientSecret` string
        in the `Authorization` header. Use the returned `access_token` as a
        `Bearer` token on all other endpoints in this API.
      operationId: createToken
      security:
        - Basic: []
      responses:
        "200":
          $ref: "#/components/responses/ResponseToken"
        "401":
          $ref: "#/components/responses/ErrorResponse401"
security:
  - Basic: []
components:
  responses:
    ResponseToken:
      description: "200: OK"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/OutputToken"
    ErrorResponse401:
      description: "401: Unauthorized"
      content:
        application/json:
          schema:
            $ref: "#/components/schemas/ErrorResponseAuthentication"
  schemas:
    OutputToken:
      type: object
      description: A successful authentication response containing a JWT bearer token.
      required:
        - access_token
        - expires_in
        - token_type
      properties:
        access_token:
          type: string
          description: The signed JWT to use as a `Bearer` token in subsequent
            authenticated requests.
          examples:
            - eyJhbGciOiJ example
        expires_in:
          type: integer
          description: The number of seconds until the token expires. After expiry,
            request a new token.
          examples:
            - 3599
        token_type:
          type: string
          description: The token type. Always `Bearer`.
          examples:
            - Bearer
    ErrorResponseAuthentication:
      title: ErrorResponseAuthentication
      type: object
      description: A response body returned when authentication fails.
      required:
        - error_message
      additionalProperties: false
      properties:
        error_message:
          type: string
          description: A human-readable description of the error.
          examples:
            - Incorrect username or password
  securitySchemes:
    Basic:
      type: http
      scheme: basic
      description: Used only by `POST /token/oauth` to obtain a bearer token. Send
        your Client ID and Client Secret as a Base64-encoded
        `clientId:clientSecret` pair.
```