# 1. Authentication

Fondo uses **OAuth 2.0 Client Credentials**.
Credentials are provided by Fondo as part of partner onboarding.
Exchange your `client_id` and `client_secret` for a bearer token — it grants access to all clients under your partner.

`client_id` not to be confused with the [client-concept](/guides/api-guide/getting-started/create-client)

Include the token in all subsequent requests:

```
Authorization: Bearer {access_token}
```

Tokens are short-lived — reuse during validity and renew on expiry.

### Trust model

The partner API uses a server-to-server trust model. A valid bearer token grants access to all accounts under your client — there is no per-request end-user identity verification from Fondo's side.

This means:

- **You are responsible for authenticating end-users** before making API calls on their behalf.
- **Operations include financial transactions** such as fund orders and withdrawals.
- The `executorRef` field on orders and withdrawals must contain the end-user's verified SSN. Fondo validates it against the account owner's SSN, but cannot verify how you obtained it.


The end-user's identity should be verified before any operation that uses `executorRef` — for example via BankID or equivalent strong authentication.

### Response schema

```json
{
  "$ref": "#/components/schemas/token_response",
  "components": {
    "schemas": {
      "token_response": {
        "$id": "/models/auth/token_response.yaml",
        "title": "Auth Token Request",
        "type": "object",
        "required": [
          "access_token",
          "expires_in"
        ],
        "properties": {
          "access_token": {
            "type": "string",
            "description": "access_token to use for subsequent requests",
            "example": "ffe74ba1-99a8-46e3-9ba2-9c0ef72e13c1"
          },
          "expires_in": {
            "type": "number",
            "description": "The lifetime in seconds of the access token. Default is 432000 (5 days)",
            "example": 432000
          },
          "state": {
            "type": "string",
            "description": "Client state. For example a base64 encoded string of state data.\n",
            "example": "VGhpcyBpcyBteSBzdGF0ZS4gVGhlcmUgYXJlIG1hbnkgbGlrZSBpdCwgYnV0IHRoaXMgaXMgb25lIG1pbmUu"
          }
        }
      }
    }
  }
}
```

**Next:** [Create a client](/guides/api-guide/getting-started/create-client)