---
title: "Get an Access Token"
description: "Request an access token: prepare your credentials, send the request to the token endpoint, read the response and use the token in other APIs."
url: "https://developer-beta.morningstar.com/authentication-api/get-an-access-token"
image: "https://developer-beta.morningstar.com/_og/d/c_Ocean.takumi,title_~R2V0IGFuIEFjY2VzcyBUb2tlbiB8IEF1dGhlbnRpY2F0aW9uIEFQSQ,description_~UmVxdWVzdCBhbiBhY2Nlc3MgdG9rZW46IHByZXBhcmUgeW91ciBjcmVkZW50aWFscywgc2VuZCB0aGUgcmVxdWVzdCB0byB0aGUgdG9rZW4gZW5kcG9pbnQsIHJlYWQgdGhlIHJlc3BvbnNlIGFuZCB1c2UgdGhlIHRva2VuIGluIG90aGVyIEFQSXMu,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMwMDAwMDAifX19,p_Ii9hdXRoZW50aWNhdGlvbi1hcGkvZ2V0LWFuLWFjY2Vzcy10b2tlbiI,s_5rKT9_CCqRUcBAPx.png"
---

-   [APIs](https://developer-beta.morningstar.com/apis)
-   [API Catalog](https://developer-beta.morningstar.com/api-catalog)
-   [API Assistant MCP Server](https://developer-beta.morningstar.com/api-assistant-mcp)
-   [Guides](https://developer-beta.morningstar.com/api-guides)
-   [Trial Access](https://developer-beta.morningstar.com/trial-access)

# Authentication API

Generate access tokens that authorize API calls.

# Get an Access Token

[View Markdown](https://developer-beta.morningstar.com/authentication-api/get-an-access-token.md)[Download Markdown](https://developer-beta.morningstar.com/authentication-api/get-an-access-token.md)

This page walks through getting an access token, one step at a time. For the ideas behind it, see [Core Concepts](https://developer-beta.morningstar.com/authentication-api/core-concepts).

## [Request Overview](#request-overview)

To get a token, send a `POST` request to the token endpoint.

```text
POST /token/oauth
```

Use the base URL for your region.

| Region   | Base URL                             |
| :------- | :----------------------------------- |
| Americas | https://www.us-api.morningstar.com   |
| APAC     | https://www.apac-api.morningstar.com |
| EMEA     | https://www.emea-api.morningstar.com |

The request needs one header, and has no body.

| Header        | Value                                    |
| :------------ | :--------------------------------------- |
| Authorization | Basic {Base64-encoded username:password} |

## [Step 1: Prepare Your Credentials](#step-1-prepare-your-credentials)

The API uses HTTP Basic authentication. Combine your username and password into one string, with a colon between them, and Base64-encode the string.

```bash
echo -n "username:password" | base64
```

Encode them as a single `username:password` string. A common mistake is to encode the username and the password separately. The colon must be included before you encode.

Many HTTP clients can do the encoding for you. For example, curl does it when you use the `--user` option.

## [Step 2: Request a Token](#step-2-request-a-token)

Send the request with your encoded credentials in the `Authorization` header.

```bash
curl --request POST \
  --url "https://www.us-api.morningstar.com/token/oauth" \
  --header "Authorization: Basic {Base64-encoded username:password}"
```

## [Step 3: Read the Response](#step-3-read-the-response)

A successful request returns `200 OK` with your token.

```json
{
  "access_token": "eyJhbGciOiJ...",
  "expires_in": 3599,
  "token_type": "Bearer"
}
```

| Property     | Description                                                                     |
| :----------- | :------------------------------------------------------------------------------ |
| access_token | The signed JWT. Use it as a Bearer token in subsequent requests.                |
| expires_in   | The number of seconds until the token expires. After that, request a new token. |
| token_type   | The token type. The value is always Bearer.                                     |

If the credentials aren't accepted, the API returns `401 Unauthorized` with an `error_message`.

```json
{
  "error_message": "Incorrect username or password"
}
```

See [Error Messages](https://developer-beta.morningstar.com/authentication-api/error-messages) and [Troubleshooting](https://developer-beta.morningstar.com/authentication-api/troubleshooting).

## [Step 4: Use the Token](#step-4-use-the-token)

Include the `access_token` as a `Bearer` token in the `Authorization` header of every request to the other APIs.

```bash
curl --request GET \
  --url "https://www.us-api.morningstar.com/direct-web-services/v1/..." \
  --header "Authorization: Bearer {access_token}"
```

Use the same token for as many requests as you like until it expires. See [Manage Tokens](https://developer-beta.morningstar.com/authentication-api/manage-tokens).

## [Next Steps](#next-steps)

-   [Manage Tokens](https://developer-beta.morningstar.com/authentication-api/manage-tokens) explains how to reuse and refresh tokens.
-   [API Inputs](https://developer-beta.morningstar.com/authentication-api/api-inputs) is a quick reference for the request and the response.