Partners

If you are one of the following types of partners, you can use the server authorization.

Financial Advisor Platforms
Self-operated quantitative platform

Introduction

For some API calls that Users do not have to participate in, the App can use this flow to retrieve Access Tokens. This flow is usually used for server-to-server interaction, as described in Section 4.4 of the RFC6749. With the received Access Token, the App can, on behalf of itself, access its own resources on resource servers, or the resources that the user authorizes the App to directly access without the authorization process, with a prior agreement.

This authorization method has only one step. The App Server directly requests an Access Token at the Token Endpoint.
- In the request, the App must set grant_type parameter to client_credentials, and pass requested scopes via scope parameter.
- The App also needs to authenticate itself by one of the methods explained in Section Authentication Method.
If the request is valid, i.e., the Authorization Server confirms the App's credentials are legit and the App can use the scopes it requested, Authorization Server will generate a JWT Access Token.
The Access Token will then be returned to the App.
- The sub payload claim of the token will be set to client:{client_id}.
- The response will also include expires_in, scope, and token_type, as explained in the Token Endpoint API document.

Please note that, in the Client Credentials Flow, the Authorization Server WILL NOT issue any refresh_token.