Authentication API

Generate access tokens that authorize API calls.

Getting Started

View MarkdownDownload Markdown

The Authentication API gives you the access token that every other Direct Web Services API requires. This guide covers the workflow for getting your first token and where to go when something goes wrong.

Workflow

1

Get your credentials

You need a username and a password for your account. They are issued when your account is set up. If you haven't received your account activation email, check your spam or junk folder, or contact your Morningstar account representative.

See Core Concepts for more about credentials.

2

Prepare your credentials

The API uses HTTP Basic authentication. Combine your username and password into one string, username:password, and Base64-encode it. The colon must be included before you encode.

See Get an Access Token for an example.

3

Request a token

Send a POST request to the token endpoint, with your encoded credentials in the Authorization header. The response contains your access token, its type and the number of seconds until it expires.

See Get an Access Token for the request and the response.

4

Use the token

Send the token as a Bearer token in the Authorization header of every request to the other APIs. A token can be reused for any number of requests while it is valid.

See Get an Access Token.

5

Refresh the token

A token is valid for 60 minutes. Track its expiry, and request a new one before it expires or when an API tells you that it has.

See Manage Tokens for how to reuse and refresh tokens.

Steps 1 and 2 are setup. Step 3 is repeated whenever you need a new token, and steps 4 and 5 are part of every integration.

Managing Issues

If a request fails or returns unexpected results:

  • Check the Error Messages page to find out what an error message means.
  • See Troubleshooting for help with common issues, such as credentials that are rejected or a token that has expired.
  • Browse the FAQs for answers to frequently asked questions.