Skip to main content

Authentication

Our Partner API uses the OAuth 2.0 client credentials flow to authenticate clients.

Requesting API Access

In order to access our APIs, you'll first need to request access by contacting us at developer-support@firstdollar.com.

Once your access request has been approved, we'll securely send you the client ID and secret.

Creating an Access Token

Once you've received a client ID and secret, you can exchange them for an access token by making a POST request to the /v0/auth/token endpoint using the client_credentials grant type.

caution

All requests to /v0/auth/token must be made over HTTPS from your backend servers, not your client code, as they require your client_id and client_secret in the request payload.

Sample Token Exchange Request (Sandbox)
POST https://api.dev.firstdollar.com/v0/auth/token HTTP/1.1
Content-Type: application/json

{
"grant_type": "client_credentials",
"client_id": "<your-client-id>",
"client_secret": "<your-client-secret>"
}
Sample Token Exchange Response
{
"access_token": "<access-token>",
"refresh_token": "<refresh-token>",
"expires_in": 3600
}

Providing the Access Token on API Requests

Once you've obtained an access token, you can provide it on API requests by including it in the Authorization header.

Sample Partner API Request (Sandbox)
POST https://api.dev.firstdollar.com/graphql HTTP/1.1
Content-Type: application/json
Authorization: Bearer <access-token>

{
"query": "query { ping }",
"variables": {}
}
Sample Partner API Response
{
"data": {
"ping": "pong"
}
}

Refreshing an Access Token

Access tokens expire after one hour. You can generate a new one using the method above or by using the refresh_token grant_type with the refresh token you obtained from a previous call to /v0/auth/token.

Note: both methods generate a new access_token.

Sample Refresh Token Request (Sandbox)
POST https://api.dev.firstdollar.com/v0/auth/token HTTP/1.1
Content-Type: application/json

{
"grant_type": "refresh_token",
"refresh_token": "<your-refresh-token>"
}
Sample Refresh Token Response
{
"access_token": "<access-token>",
"refresh_token": "<refresh-token>",
"expires_in": 3600
}