Skip to content

Authentication

1 min readLast updated Oct 19, 2026

Efimis REST APIs use OAuth 2.0 for secure authentication and authorization. Applications use the OAuth 2.0 client credentials flow described below.

For Claude, Codex and ChatGPT connections, follow the MCP authentication guide. Supported MCP clients handle sign-in and token management for you.

Client credentials flow (machine-to-machine)

Section titled “Client credentials flow (machine-to-machine)”

Use this flow for backend services or applications without user interaction.

Request an access token

Terminal window
curl --fail-with-body -sS -X POST "$EFIMIS_AUTH_URL" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=$EFIMIS_CLIENT_ID" \
  --data-urlencode "client_secret=$EFIMIS_CLIENT_SECRET" \
  --data-urlencode "scope=$EFIMIS_API_SCOPE"

Your issued credentials include EFIMIS_AUTH_URL and EFIMIS_API_SCOPE.

Response

{
  "access_token": "eyJhbGciOiJIUzI1...",
  "token_type": "Bearer",
  "not_before": 1749554835,
  "expires_in": 43200,
  "expires_on": 1749598035,
  "resource": "[RESOURCE ID]"
}

Authorization code flow (user authentication)

Section titled “Authorization code flow (user authentication)”

This flow allows a user to authenticate and grant access to their data.

Making authenticated requests

Section titled “Making authenticated requests”

Include the access_token in the Authorization header for all API requests.

GET /your-tenant-alias/api/v1/clients HTTP/1.1
Host: api.uk.efimis.com
Authorization: Bearer OAUTH_ACCESS_TOKEN

For an Australian tenant, use api.au.efimis.com and the Australian tenant alias in the request path.

Security best practices

Section titled “Security best practices”
  • Store credentials securely.
  • Use HTTPS.
  • Implement least privilege.

For sandbox access and developer keys, contact connections@efimis.com.