{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml","oas-openapi/api.yaml":"oas-openapi/api.yaml"},"props":{"metadata":{"markdoc":{"tagList":["openapi-code-sample","json-schema"]},"type":"markdown"},"seo":{"title":"1. Authentication","description":"Fondo is the ground breaking open finance platform that lets you focus on what matters","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":["openapi"],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"1-authentication","__idx":0},"children":["1. Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Fondo uses ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OAuth 2.0 Client Credentials"]},"."," ","Credentials are provided by Fondo as part of partner onboarding."," ","Exchange your ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," for a bearer token — it grants access to all clients under your partner."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," not to be confused with the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/api-guide/getting-started/create-client"},"children":["client-concept"]}]},{"$$mdtype":"Tag","name":"OpenApiCodeSample","attributes":{"descriptionFile":"oas-openapi/api.yaml","operationId":"authToken","parameters":{},"environments":{}},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include the token in all subsequent requests:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Authorization: Bearer {access_token}\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tokens are short-lived — reuse during validity and renew on expiry."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"trust-model","__idx":1},"children":["Trust model"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The partner API uses a server-to-server trust model. A valid bearer token grants access to all accounts under your client — there is no per-request end-user identity verification from Fondo's side."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This means:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["You are responsible for authenticating end-users"]}," before making API calls on their behalf."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Operations include financial transactions"]}," such as fund orders and withdrawals."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["executorRef"]}," field on orders and withdrawals must contain the end-user's verified SSN. Fondo validates it against the account owner's SSN, but cannot verify how you obtained it."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The end-user's identity should be verified before any operation that uses ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["executorRef"]}," — for example via BankID or equivalent strong authentication."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"response-schema","__idx":2},"children":["Response schema"]},{"$$mdtype":"Tag","name":"JsonSchema","attributes":{"schema":{"$ref":"../../../openapi/models/auth/token_response.yaml"},"options":{},"schemaResolved":{"openapi":"3.1.0","components":{"schemas":{"__root":{"$ref":"#/components/schemas/token_response"},"token_response":{"$id":"/models/auth/token_response.yaml","title":"Auth Token Request","type":"object","required":["access_token","expires_in"],"properties":{"access_token":{"type":"string","description":"access_token to use for subsequent requests","example":"ffe74ba1-99a8-46e3-9ba2-9c0ef72e13c1"},"expires_in":{"type":"number","description":"The lifetime in seconds of the access token. Default is 432000 (5 days)","example":432000},"state":{"type":"string","description":"Client state. For example a base64 encoded string of state data.\n","example":"VGhpcyBpcyBteSBzdGF0ZS4gVGhlcmUgYXJlIG1hbnkgbGlrZSBpdCwgYnV0IHRoaXMgaXMgb25lIG1pbmUu"}}}}}},"schemaResolvedErrors":[]},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next:"]}," ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/guides/api-guide/getting-started/create-client"},"children":["Create a client"]}]}]},"headings":[{"value":"1. Authentication","id":"1-authentication","depth":1},{"value":"Trust model","id":"trust-model","depth":3},{"value":"Response schema","id":"response-schema","depth":3}],"frontmatter":{"seo":{"title":"1. Authentication"}},"lastModified":"2026-04-14T12:45:03.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/api-guide/getting-started/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}