---
updatedAt: 2026-07-28T08:16:07.000Z
---

Fetch the complete documentation index at: https://enterprise-docs.itigerup.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version.

# Server Authorization

## Partners

If you are one of the following types of partners, you can use the server authorization.

* Financial Advisor Platforms
* Self-operated quantitative platforms

## Introduction

For API calls that do not require user participation, the App can use this flow to retrieve Access Tokens.
This flow is typically used for server-to-server interaction, as described in Section 4.4 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4).
With the received Access Token, the App can access its own resources on resource servers on behalf of itself, or access resources that the user has authorized the App to access directly without an authorization prompt, per a prior agreement.

<Image align="center" alt="```mermaid sequenceDiagram     autonumber     participant client as App Server     participant token as Token Endpoint     client ->>+ token: Authenticates (client_id, client_secret), scope, audience     token ->> token: Verify request & Generate token     token -->>- client: Access Token ```" border={false} src="https://files.readme.io/d85a24daedbe936ac2839259da7ceb849fc2331cc9cb66d1715ae13eb1c08704-client-credentials-flow.png" />

1. This authorization method has only one step. The App Server directly requests an Access Token at the Token Endpoint.
   * In the request, the App must set `grant_type` parameter to `client_credentials`, and pass requested scopes via `scope` parameter.
   * The App also needs to authenticate itself by one of the methods explained in Section [Authentication Method](./other.md#authentication-method).
2. If the request is valid — i.e., the Authorization Server confirms the App's credentials are legitimate and the App is allowed to use the requested scopes — the Authorization Server will generate a JWT Access Token.
3. The Access Token will then be returned to the App.
   * The `sub` payload claim of the token will be set to `client:{client_id}`.
   * The response will also include `expires_in`, `scope`, and `token_type`, as explained in the Token Endpoint API document.

> Please note that, in the Client Credentials Flow, the Authorization Server WILL NOT issue any `refresh_token`.