> ## Documentation Index
> Fetch the complete documentation index at: https://docs.finventi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Regulatory Reporting Connector API.

## Overview

The RRC API uses OAuth 2.0 for authentication. To access the API, you need to obtain a bearer token from the authorization server and include it in all API requests.

<Note>
  **IP Whitelisting Required**: Before you can access the API, your IP address must be whitelisted. Contact us to register your IP addresses.
</Note>

## Obtaining a Bearer Token

To authenticate with the API, you need to obtain a bearer token using the OAuth 2.0 client credentials flow.

### Token Request

Use the following cURL command to obtain a bearer token:

```bash theme={null}
curl -X POST \
  --location 'https://auth.sandbox.finventi.com/realms/sti-connector/protocol/openid-connect/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=<your-client-id>' \
  --data-urlencode 'client_secret=<your-client-secret>'
```

### Parameters

<ParamField body="grant_type" type="string" required>
  Must be set to `client_credentials`
</ParamField>

<ParamField body="client_id" type="string" required>
  Your client ID provided during onboarding
</ParamField>

<ParamField body="client_secret" type="string" required>
  Your client secret provided during onboarding
</ParamField>

### Variables to Replace

* **`<your-client-id>`**: Your client ID provided during onboarding
* **`<your-client-secret>`**: Your client secret provided during onboarding

### Token Response

A successful response will include your access token:

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6IC...",
  "expires_in": 2700,
  "refresh_expires_in": 0,
  "token_type": "Bearer",
  "not-before-policy": 0,
  "scope": "profile email"
}
```

<Warning>
  The bearer token is valid for **45 minutes**. After expiration, you'll need to request a new token.
</Warning>

## Using the Bearer Token

Include the bearer token in the `Authorization` header of all API requests with the `Bearer` prefix.

### Authorization Header Format

```
Authorization: Bearer <bearer-token>
```

## Best Practices

<CardGroup cols={2}>
  <Card title="Token Management" icon="key">
    * Cache tokens until they expire
    * Implement token refresh logic before expiration
    * Never expose tokens in client-side code
  </Card>

  <Card title="Security" icon="shield">
    * Store client secrets securely
    * Use environment variables for credentials
    * Rotate client secrets regularly
  </Card>
</CardGroup>

## Common Issues

### Invalid Client Credentials

If you receive an authentication error, verify:

* Your client secret is correct and hasn't been rotated
* Your IP address is whitelisted

### Expired Token

If you receive a 401 Unauthorized error:

* Check if 45 minutes have passed since token generation
* Request a new bearer token
* Update your application's token cache

## Next Steps

Once authenticated, you can access RRC services:

* [MMR-SASK Overview](/regulatory/rrc/mmr-sask/overview)