Authentication
Obtain an Access Token with the OAuth2 Client Credentials flow.
The API uses the OAuth2 Client Credentials flow for authentication. A token is valid for 2 hours. Cache and reuse it on your side, and refresh it before it expires.
Get an Access Token
Endpoint: POST /oauth2/token
Request headers:
Content-Type: application/x-www-form-urlencoded
X-Tenant-ID: {tenant_id}
X-Tenant-Type: COMPANYIf X-Tenant-ID or X-Tenant-Type is missing, the endpoint returns invalid_client.
Request parameters (application/x-www-form-urlencoded):
| Parameter | Description | Required |
|---|---|---|
grant_type | Fixed value client_credentials | Y |
client_id | Client ID, created under Integrations → Keys in the Dashboard | Y |
client_secret | Client secret, created together with client_id | Y |
scope | Fixed value company:TENANT:admin | Y |
Request example (test environment):
curl -X POST "https://api.test.stabofx.com/oauth2/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "X-Tenant-ID: your_tenant_id" \
-H "X-Tenant-Type: COMPANY" \
-d "grant_type=client_credentials&client_id=your_client_id&client_secret=your_client_secret&scope=company:TENANT:admin"Response example:
{
"access_token": "eyJhbGciOiJSUzI1NiIs...",
"token_type": "Bearer",
"expires_in": 7200
}expires_in is in seconds.
Use the token
Business APIs authenticate requests with the Authorization: Bearer {accessToken} header.
Best practice: Cache the token in your application and reuse it. Do not request a new token for every call. If you receive a 401 error, request a new token.