It authenticates your account and returns the access token that every other Direct Web Services API requires. You send your credentials once, receive a token, and use it in each request to the other APIs. See Core Concepts.

The API has one endpoint: POST /token/oauth. Use the base URL for your region.

• Americas: https://www.us-api.morningstar.com
• APAC: https://www.apac-api.morningstar.com
• EMEA: https://www.emea-api.morningstar.com

Every Direct Web Services API requires a valid token in the Authorization header, and a token can be reused for any number of requests while it is valid.

Your username and password are issued when your account is set up. If you haven't received your account activation email, check your spam or junk folder. If it isn't there, contact your Morningstar account representative to confirm that the correct email address was registered, and ask for the email to be sent again.

Send them in the Authorization header as Basic followed by your Base64-encoded username:password. See Get an Access Token.

Check that you are Base64-encoding the username and password as one username:password string. A common mistake is to encode them separately. The colon must be included before you encode.

A token is valid for 60 minutes. The response includes expires_in, the number of seconds until it expires.

Yes. A token can be reused for any number of requests within its 60 minutes. There is no need to request a new token for each request.

If you request a new token within 10 minutes of generating one, the API returns the same token. See Manage Tokens.

The API you call returns 401 Unauthorized. Request a new token with your credentials, then retry the request. You can build this into your application so that it refreshes tokens automatically. See Manage Tokens.

Use expires_in from the response. Add it to the time you received the token, and keep that expiry time with the token.