Skip to main content
POST
/
v1
/
oauth
/
token
Issue a Token
curl --request POST \
  --url https://sandbox.api.fin.com/v1/oauth/token \
  --header 'Content-Type: application/json' \
  --data '
{
  "client_id": "<string>",
  "client_secret": "<string>"
}
'
const url = 'https://sandbox.api.fin.com/v1/oauth/token';
const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({client_id: '<string>', client_secret: '<string>'})
};

fetch(url, options)
.then(res => res.json())
.then(json => console.log(json))
.catch(err => console.error(err));
HttpResponse<String> response = Unirest.post("https://sandbox.api.fin.com/v1/oauth/token")
.header("Content-Type", "application/json")
.body("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\"\n}")
.asString();
import requests

url = "https://sandbox.api.fin.com/v1/oauth/token"

payload = {
"client_id": "<string>",
"client_secret": "<string>"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
package main

import (
"fmt"
"strings"
"net/http"
"io"
)

func main() {

url := "https://sandbox.api.fin.com/v1/oauth/token"

payload := strings.NewReader("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\"\n}")

req, _ := http.NewRequest("POST", url, payload)

req.Header.Add("Content-Type", "application/json")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "access_token_ttl": "2025-12-28 10:34:45+00",
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "refresh_token_ttl": "2025-12-28 10:34:45+00",
  "current_time": "2025-12-21 10:34:45+00"
}
{
"message": "Authentication failed"
}
{
"message": "<string>",
"errors": [
{}
]
}
Grab your client_id and client_secret from the API Keys section of the Orchestration Dashboard
  • The TTLs returned from this API are actually the time that the token will expire; i.e. not validity in number of seconds since creation.
  • The timestamps, i.e. TTLs returned from this endpoint are NOT in ISO 8601 format. Rather it is in the format YYYY-MM-DD HH:MM:SS+00.

Body

application/json
client_id
string
required

Client ID

client_secret
string<password>
required

Client Secret

Response

Token issued successfully

access_token
string
Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

access_token_ttl
string<date-time>
Example:

"2025-12-28 10:34:45+00"

refresh_token
string
Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

refresh_token_ttl
string<date-time>
Example:

"2025-12-28 10:34:45+00"

current_time
string<date-time>
Example:

"2025-12-21 10:34:45+00"