# Install & authenticate

Install, authenticate, and initialize Moov.js in your application.

After installation, you'll generate a token server-side to communicate between Moov and your account. You'll also set [scopes](/api/authentication/scopes/) to make API calls from Moov.js.

## [Install](#install)

Include Moov.js in your application by loading the Moov.js script, or downloading the Moov.js package via [npm](https://www.npmjs.com/package/@moovio/moov-js?activeTab=readme).

[Script tag](#tab-793824561-1-0) [npm](#tab-793824561-1-1)

```html
<script type="text/javascript" src="https://js.moov.io/v1"></script>
```

```zsh
npm i @moovio/moov-js
```

## [Authenticate](#authenticate)

For each action you take with Moov.js, you'll need a unique short lived access token that contains information needed to securely communicate with your Moov account.

You must generate tokens from your server-side application. Once you’ve generated a token, send it back to your client to use with Moov.js.

![Token generation process diagram](images/token-diagram-moovjs-light.png)

### [Create an access token](#create-an-access-token)

The examples below create an access token with a scope set to create an account. See the [scopes](/api/authentication/scopes/) documentation for more information.

[cURL](#tab-629548317-3-0)

```zsh
curl -X POST "https://api.moov.io/oauth2/token" \
  -u "PUBLIC_KEY:PRIVATE_KEY" \
  -H "Origin: https://your-domain.com" \
  --data '{
    "grant_type":"client_credentials",
    "client_id":"5clTR_MdVrrkgxw2",
    "client_secret":"dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-",
    "scope":"/accounts.write",
    "refresh_token":"i1qxz68gu50zp4i8ceyxqogmq7y0yienm52351c6..."
  }'\
```

> **Note:** Replace `https://your-domain.com` with scheme and domain only (no path) matching a domain registered in your API key's allowed domain list in the Dashboard under **Developers → API keys**. Even if you have multiple domains registered, set only one — the one the current request originates from. `localhost` is not an accepted domain. Failure to set the header correctly will cause subsequent API calls made with the token to fail with a 401.

## [Initialize](#initialize)

Once you've generated a token from your server, initialize Moov.js in the browser by passing the token to Moov.

[Script installation](#tab-574682913-4-0) [npm installation](#tab-574682913-4-1)

```html
<script>
  const moov = Moov(token)
</script>
```

```javascript
import { loadMoov } from '@moovio/moov-js';

const moovAccessToken = await fetch(...);
const moov = await loadMoov(moovAccessToken);
```

## [Next steps](#next-steps)

- Learn what [scopes](/api/authentication/scopes/) are available for Moov.js actions
- Check out Moov.js [Drops](/moovjs/drops/), a collection of UI components