---
title: "FAQs"
description: "Answers to common questions about the Authentication API: credentials, tokens, expiry and caching."
url: "https://developer-beta.morningstar.com/authentication-api/faqs"
image: "https://developer-beta.morningstar.com/_og/d/c_Ocean.takumi,title_~RkFRcyB8IEF1dGhlbnRpY2F0aW9uIEFQSQ,description_~QW5zd2VycyB0byBjb21tb24gcXVlc3Rpb25zIGFib3V0IHRoZSBBdXRoZW50aWNhdGlvbiBBUEk6IGNyZWRlbnRpYWxzLCB0b2tlbnMsIGV4cGlyeSBhbmQgY2FjaGluZy4,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMwMDAwMDAifX19,p_Ii9hdXRoZW50aWNhdGlvbi1hcGkvZmFxcyI,s_bghPp7m1DBdiJR9A.png"
---

-   [APIs](https://developer-beta.morningstar.com/apis)
-   [API Catalog](https://developer-beta.morningstar.com/api-catalog)
-   [API Assistant MCP Server](https://developer-beta.morningstar.com/api-assistant-mcp)
-   [Guides](https://developer-beta.morningstar.com/api-guides)
-   [Trial Access](https://developer-beta.morningstar.com/trial-access)

# Authentication API

Generate access tokens that authorize API calls.

# FAQs

[View Markdown](https://developer-beta.morningstar.com/authentication-api/faqs.md)[Download Markdown](https://developer-beta.morningstar.com/authentication-api/faqs.md)

Answers to common questions about the Authentication API. If a request fails or returns unexpected results, see [Troubleshooting](https://developer-beta.morningstar.com/authentication-api/troubleshooting).

## [General](#general)

What does the Authentication API do?

It authenticates your account and returns the access token that every other Direct Web Services API requires. You send your credentials once, receive a token, and use it in each request to the other APIs. See [Core Concepts](https://developer-beta.morningstar.com/authentication-api/core-concepts).

---

What endpoint does the API have?

The API has one endpoint: `POST /token/oauth`. Use the base URL for your region.

-   Americas: `https://www.us-api.morningstar.com`
-   APAC: `https://www.apac-api.morningstar.com`
-   EMEA: `https://www.emea-api.morningstar.com`

---

Do all the APIs use the same token?

Every Direct Web Services API requires a valid token in the `Authorization` header, and a token can be reused for any number of requests while it is valid.

---

## [Credentials](#credentials)

Where do I get my credentials?

Your username and password are issued when your account is set up. If you haven't received your account activation email, check your spam or junk folder. If it isn't there, contact your Morningstar account representative to confirm that the correct email address was registered, and ask for the email to be sent again.

---

How do I send my credentials?

Send them in the `Authorization` header as `Basic` followed by your Base64-encoded `username:password`. See [Get an Access Token](https://developer-beta.morningstar.com/authentication-api/get-an-access-token#step-1-prepare-your-credentials).

---

My credentials are correct but I get an authentication error. What could be causing it?

Check that you are Base64-encoding the username and password as one `username:password` string. A common mistake is to encode them separately. The colon must be included before you encode.

---

## [Tokens](#tokens)

How long does a token last?

A token is valid for 60 minutes. The response includes `expires_in`, the number of seconds until it expires.

---

Can I use the same token for multiple requests?

Yes. A token can be reused for any number of requests within its 60 minutes. There is no need to request a new token for each request.

---

Why did I get the same token when I asked for a new one?

If you request a new token within 10 minutes of generating one, the API returns the same token. See [Manage Tokens](https://developer-beta.morningstar.com/authentication-api/manage-tokens#token-caching).

---

What do I do when my token expires?

The API you call returns `401 Unauthorized`. Request a new token with your credentials, then retry the request. You can build this into your application so that it refreshes tokens automatically. See [Manage Tokens](https://developer-beta.morningstar.com/authentication-api/manage-tokens#refresh-when-the-token-expires).

---

How do I know when a token will expire?

Use `expires_in` from the response. Add it to the time you received the token, and keep that expiry time with the token.

---