---
title: "Core Concepts"
description: "Understand the key ideas behind the Authentication API: credentials, access tokens, token lifetime and caching."
url: "https://developer-beta.morningstar.com/authentication-api/core-concepts"
image: "https://developer-beta.morningstar.com/_og/d/c_Ocean.takumi,title_~Q29yZSBDb25jZXB0cyB8IEF1dGhlbnRpY2F0aW9uIEFQSQ,description_~VW5kZXJzdGFuZCB0aGUga2V5IGlkZWFzIGJlaGluZCB0aGUgQXV0aGVudGljYXRpb24gQVBJOiBjcmVkZW50aWFscywgYWNjZXNzIHRva2VucywgdG9rZW4gbGlmZXRpbWUgYW5kIGNhY2hpbmcu,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMwMDAwMDAifX19,p_Ii9hdXRoZW50aWNhdGlvbi1hcGkvY29yZS1jb25jZXB0cyI,s_YNWCEZQUoBJux8o_.png"
---

-   [APIs](https://developer-beta.morningstar.com/apis)
-   [API Catalog](https://developer-beta.morningstar.com/api-catalog)
-   [API Assistant MCP Server](https://developer-beta.morningstar.com/api-assistant-mcp)
-   [Guides](https://developer-beta.morningstar.com/api-guides)
-   [Trial Access](https://developer-beta.morningstar.com/trial-access)

# Authentication API

Generate access tokens that authorize API calls.

# Core Concepts

[View Markdown](https://developer-beta.morningstar.com/authentication-api/core-concepts.md)[Download Markdown](https://developer-beta.morningstar.com/authentication-api/core-concepts.md)

The Authentication API returns the access token that every other Direct Web Services API needs. This page introduces the key ideas, and links to the articles that explain each one in detail.

## [Credentials](#credentials)

You authenticate with your username and password, which are issued when your account is set up. The API uses HTTP Basic authentication, so you send them as a Base64-encoded `username:password` string in the `Authorization` header.

-   [Get an Access Token](https://developer-beta.morningstar.com/authentication-api/get-an-access-token#step-1-prepare-your-credentials) explains how to prepare your credentials.

## [Access Tokens](#access-tokens)

The API returns a signed JSON Web Token (JWT). You send it as a `Bearer` token in the `Authorization` header of every request to the other APIs. The response also tells you the token type and how many seconds the token is valid for.

-   [Get an Access Token](https://developer-beta.morningstar.com/authentication-api/get-an-access-token#step-3-read-the-response) explains the response.

## [Token Lifetime](#token-lifetime)

A token is valid for 60 minutes, and can be reused for any number of requests during that time. If you request a new token within 10 minutes of generating one, the API returns the same token. When a token expires, the API returns an error, and you request a new one.

-   [Manage Tokens](https://developer-beta.morningstar.com/authentication-api/manage-tokens) explains how to reuse, track and refresh tokens.

## [Regions](#regions)

The token endpoint is available in each region. Use the base URL for your region, and the same region for the requests that you make with the token.

-   [Get an Access Token](https://developer-beta.morningstar.com/authentication-api/get-an-access-token#request-overview) lists the base URLs.