Server Authorization

Partners

If you are one of the following types of partners, you can use the server authorization.

• Financial Advisor Platforms
• Self-operated quantitative platforms

Introduction

For API calls that do not require user participation, the App can use this flow to retrieve Access Tokens.
This flow is typically used for server-to-server interaction, as described in Section 4.4 of RFC6749.
With the received Access Token, the App can access its own resources on resource servers on behalf of itself, or access resources that the user has authorized the App to access directly without an authorization prompt, per a prior agreement.

1. This authorization method has only one step. The App Server directly requests an Access Token at the Token Endpoint.
   • In the request, the App must set grant_type parameter to client_credentials, and pass requested scopes via scope parameter.
   • The App also needs to authenticate itself by one of the methods explained in Section Authentication Method.
2. If the request is valid — i.e., the Authorization Server confirms the App's credentials are legitimate and the App is allowed to use the requested scopes — the Authorization Server will generate a JWT Access Token.
3. The Access Token will then be returned to the App.
   • The sub payload claim of the token will be set to client:{client_id}.
   • The response will also include expires_in, scope, and token_type, as explained in the Token Endpoint API document.

Please note that, in the Client Credentials Flow, the Authorization Server WILL NOT issue any refresh_token.