Skip to content

Authentication

1 min readLast updated Sep 9, 2026

Efimis APIs use OAuth 2.0 for secure authentication and authorization. Applications must use the OAuth 2.0 client credentials flow to access APIs.

Client credentials flow (machine-to-machine)

Section titled “Client credentials flow (machine-to-machine)”

Use this flow for backend services or applications without user interaction.

Request an access token

Terminal window
curl --fail-with-body -sS -X POST "$EFIMIS_AUTH_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=$EFIMIS_CLIENT_ID" \
  --data-urlencode "client_secret=$EFIMIS_CLIENT_SECRET" \
  --data-urlencode "scope=$EFIMIS_API_SCOPE"

Your issued credentials include EFIMIS_AUTH_URL and EFIMIS_API_SCOPE.

Response

{
  "access_token": "eyJhbGciOiJIUzI1...",
  "token_type": "Bearer",
  "not_before": 1749554835,
  "expires_in": 43200,
  "expires_on": 1749598035,
  "resource": "[RESOURCE ID]"
}

Authorization code flow (user authentication)

Section titled “Authorization code flow (user authentication)”

Use this flow when a user needs to authenticate and grant access to their data.

Making authenticated requests

Section titled “Making authenticated requests”

Include the access_token in the Authorization header for all API requests.

GET /your-tenant-alias/api/v1/clients HTTP/1.1
Host: api.uk.efimis.com
Authorization: Bearer OAUTH_ACCESS_TOKEN

For an Australian tenant, use api.au.efimis.com and the Australian tenant alias in the request path.

Security best practices

Section titled “Security best practices”
  • Store credentials securely.
  • Use HTTPS.
  • Implement least privilege.

For sandbox access and developer keys, contact connections@efimis.com.