The response is 401 with the message Incorrect username or password.

• Check your username and password for typos.
• Check that you encoded them as one username:password string, with the colon between them.
• Check that the header is Authorization: Basic ..., with a space after Basic and no line break in the encoded value. Some tools add a line break when they encode.
• If you have not activated your account, check your spam or junk folder for the activation email, or contact your Morningstar account representative.

See Get an Access Token.

The most common cause is the encoding.

• Encode the username and password as a single username:password string. Don't encode them separately.
• Include the colon before you encode.
• Use Base64 encoding, not URL encoding.
• Use echo -n when you encode on the command line, so that a newline isn't added to the string.

See Get an Access Token.

Check your spam or junk folder. If the email isn't there, contact your Morningstar account representative to confirm that the correct email address was registered, and ask for the email to be sent again.

The API rejected the token.

• Check that the header is Authorization: Bearer {access_token}. Don't send Basic credentials to the other APIs.
• Check that you are sending the access_token value from the response, with no extra characters or quotation marks.
• Check whether the token has expired. Tokens are valid for 60 minutes.
• If it has expired, request a new token and retry the request. See Manage Tokens.

Tokens are valid for 60 minutes, so long jobs can outlast one.

• Track the expiry time of the token, using expires_in.
• Refresh the token before it expires, and check it before each request.
• If a request returns 401, request a new token and retry that request.

See Manage Tokens.

If you request a token within 10 minutes of generating one, the API returns the same token. This is expected. Keep using it until it expires.

See Manage Tokens.