Ask Moov Beta
Generative AI is experimental and can make mistakes.
Guides Use cases API Changelog
  1. API reference
  2. v2025.01.00
  3. Authentication
  4. Access tokens

Create an access token

Create or refresh an access token.
POST
/oauth2/token
cURL TypeScript PHP Python Java Ruby 
curl -X POST "https://api.moov.io/oauth2/token" \
  -u "PUBLIC_KEY:PRIVATE_KEY" \
  --data '{
    "grant_type":"client_credentials",
    "client_id":"5clTR_MdVrrkgxw2",
    "client_secret":"dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-",
    "scope":"/accounts.write",
    "refresh_token":"i1qxz68gu50zp4i8ceyxqogmq7y0yienm52351c6..."
  }'\

import { SDK } from "openapi";

const sdk = new SDK({
  xMoovVersion: "v2024.01.00",
});

async function run() {
  const result = await sdk.authentication.createAccessToken({
    grantType: "client_credentials",
    clientId: "5clTR_MdVrrkgxw2",
    clientSecret: "dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-",
    scope: "/accounts.read /accounts.write",
    refreshToken: "eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...",
  });

  console.log(result);
}

run();
declare(strict_types=1);

require 'vendor/autoload.php';

use OpenAPI\OpenAPI;
use OpenAPI\OpenAPI\Models\Components;

$sdk = OpenAPI\SDK::builder()
    ->setXMoovVersion('v2024.01.00')
    ->build();

$authTokenRequest = new Components\AuthTokenRequest(
    grantType: Components\GrantType::ClientCredentials,
    clientId: '5clTR_MdVrrkgxw2',
    clientSecret: 'dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-',
    scope: '/accounts.read /accounts.write',
    refreshToken: 'eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...',
);

$response = $sdk->authentication->createAccessToken(
    authTokenRequest: $authTokenRequest
);

if ($response->authToken !== null) {
    // handle response
}
from openapi import SDK


with SDK(
    x_moov_version="v2024.01.00",
) as sdk:

    res = sdk.authentication.create_access_token(grant_type="client_credentials", client_id="5clTR_MdVrrkgxw2", client_secret="dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-", scope="/accounts.read /accounts.write", refresh_token="eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...")

    # Handle response
    print(res)
package hello.world;

import java.lang.Exception;
import org.openapis.openapi.SDK;
import org.openapis.openapi.models.components.AuthTokenRequest;
import org.openapis.openapi.models.components.GrantType;
import org.openapis.openapi.models.errors.AuthTokenRequestError;
import org.openapis.openapi.models.errors.GenericError;
import org.openapis.openapi.models.operations.CreateAccessTokenResponse;

public class Application {

    public static void main(String[] args) throws GenericError, AuthTokenRequestError, Exception {

        SDK sdk = SDK.builder()
                .xMoovVersion("v2024.01.00")
            .build();

        AuthTokenRequest req = AuthTokenRequest.builder()
                .grantType(GrantType.CLIENT_CREDENTIALS)
                .clientId("5clTR_MdVrrkgxw2")
                .clientSecret("dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-")
                .scope("/accounts.read /accounts.write")
                .refreshToken("eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...")
                .build();

        CreateAccessTokenResponse res = sdk.authentication().createAccessToken()
                .request(req)
                .call();

        if (res.authToken().isPresent()) {
            // handle response
        }
    }
}
require 'openapi'

Models = ::OpenApiSDK::Models
s = ::OpenApiSDK::SDK.new(
      x_moov_version: 'v2024.01.00',
    )

res = s.authentication.create_access_token(auth_token_request: Models::Components::AuthTokenRequest.new(
  grant_type: Models::Components::GrantType::CLIENT_CREDENTIALS,
  client_id: '5clTR_MdVrrkgxw2',
  client_secret: 'dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-',
  scope: '/accounts.read /accounts.write',
  refresh_token: 'eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...',
))

unless res.auth_token.nil?
  # handle response
end
200 400 422 429 500 504
The request completed successfully.
application/json
Example
{
  "token_type": "Bearer",
  "access_token": "eyJhbGciOiJFZERTQSIsImN0eSI6IkpXVCIsImtpZCI6IkR...",
  "refresh_token": "eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...",
  "expires_in": 1736964352,
  "scope": "/accounts.read /accounts.write"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The server could not understand the request due to invalid syntax.
application/json
Example
{
  "error": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.
application/json
Example
{
  "scope": "string",
  "refresh_token": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
Request was refused due to rate limiting.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed due to an unexpected error.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed because a downstream service failed to respond.

Response headers

x-request-id

string required
A unique identifier used to trace requests.

Headers

X-Moov-Version

string

Specify an API version.

API versioning follows the format vYYYY.QQ.BB, where

  • YYYY is the year
  • QQ is the two-digit month for the first month of the quarter (e.g., 01, 04, 07, 10)
  • BB is the build number, starting at .01, for subsequent builds in the same quarter.
    • For example, v2024.01.00 is the initial release of the first quarter of 2024.

The dev version represents the most recent development state. It may include breaking changes and should be treated as a beta release. When no version is specified, the API defaults to v2024.01.00.

Body

application/json

grant_type

string<enum> required

The type of grant being requested.

  • client_credentials: A grant type used by clients to obtain an access token
  • refresh_token: A grant type used by clients to obtain a new access token using a refresh token
Possible values: client_credentials, refresh_token

client_id

string
Client ID can be provided here in the body, or as the Username in HTTP Basic Auth.

client_secret

string
Client secret can be provided here in the body, or as the Password in HTTP Basic Auth.

refresh_token

string
The refresh_token returned alongside the access token being refreshed. Required when grant_type is refresh_token.

scope

string
A space delimited list of scopes. Required when grant_type is client_credentials.

Response

application/json

access_token

string <=4096 characters required
A value passed to the authorization server to gain access to the system.

expires_in

integer<int32> required
Unix timestamp indicating when this token expires.

refresh_token

string <=4096 characters required
A value passed to the authorization server to obtain a new access token.

scope

string required
A space-delimited list of scopes that are allowed.

token_type

string<enum> required
An RFC 6750 token type.
Possible values: Bearer