> ## Documentation Index
> Fetch the complete documentation index at: https://docs.floris3.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate

> Exchange client credentials for a short-lived bearer access token.



## OpenAPI

````yaml /openapi/2026-07-02.yaml post /_api/auth
openapi: 3.0.3
info:
  title: Simply Tokenized API
  description: >-
    Simply Tokenized API for integrators and partners.


    **Current version `2026-07-02` is in beta** and is only available on the
    **development** environment (`https://dev.go.simplytokenized.com/_api`).
    Request and response shapes may change before a stable release. Beta
    responses include `ST-Api-Version-Beta: true`.


    | Environment | Base URL |

    |-------------|----------|

    | Development | `https://dev.go.simplytokenized.com/_api` |

    | Staging | `https://stage.go.floris3.com/_api` |

    | Live | `https://go.floris3.com/_api` |


    Authenticate with client credentials at `POST /_api/auth`, then call
    resource endpoints with `Authorization: Bearer {access_token}`.


    All successful responses include the `ST-Api-Version` header. The access
    token is valid for 10 minutes.


    **Token amounts:** Fields named `units` and `balance` are integer strings in
    the smallest token unit. Read `decimals` from the offering and multiply the
    human amount by `10^decimals` (e.g. 10 tokens with 8 decimals →
    `"10000000000"`). See the Units and decimals guide in the docs.
  version: '2026-07-02'
servers:
  - url: https://dev.go.simplytokenized.com
    description: Development — beta API version `2026-07-02` available
  - url: https://stage.go.floris3.com
    description: Staging
  - url: https://go.floris3.com
    description: Live (production)
security:
  - bearerAuth: []
tags:
  - name: Auth
    description: Obtain a bearer access token.
  - name: Offerings
    description: List and retrieve offerings.
  - name: Orders
    description: >-
      Create, list, retrieve, and cancel orders. Send `units` in the smallest
      token unit — see Units and decimals in the Guides tab.
  - name: Accounts
    description: Create and manage investor accounts.
  - name: Wallets
    description: List wallets and wallet balances.
  - name: Transactions
    description: Account transaction history.
  - name: Benefiting Persons
    description: Beneficial ownership records.
paths:
  /_api/auth:
    post:
      tags:
        - Auth
      summary: Authenticate
      description: Exchange client credentials for a short-lived bearer access token.
      operationId: authenticate
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                  minLength: 1
                client_secret:
                  type: string
                  minLength: 1
                scopes:
                  minItems: 1
                  type: array
                  items:
                    type: string
                    enum:
                      - offering.read
                      - account.create
                      - account.read
                      - account.update
                      - wallet.read
                      - order.create
                      - order.read
                      - order.update
                      - order.delete
                api_version:
                  type: string
                  description: >-
                    API contract version for this docs release. Locked to
                    `2026-07-02`.
                  default: '2026-07-02'
                  x-default: '2026-07-02'
                  example: '2026-07-02'
                  enum:
                    - '2026-07-02'
                  x-mint:
                    post:
                      - locked
              required:
                - client_id
                - client_secret
                - scopes
                - api_version
              additionalProperties: false
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                    enum:
                      - Bearer
                  expires_at:
                    type: string
                    format: date-time
                required:
                  - access_token
                  - token_type
                  - expires_at
                additionalProperties: false
              example:
                access_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
                token_type: Bearer
                expires_at: '2026-07-10T14:03:00.000Z'
        '400':
          description: Bad Request – validation failed
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                      code:
                        type: string
                      message:
                        type: string
                      errors:
                        type: array
                        items: {}
                    required:
                      - type
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '401':
          description: Unauthorized – invalid or missing access token
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                      code:
                        type: string
                      message:
                        type: string
                      errors:
                        type: array
                        items: {}
                    required:
                      - type
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '403':
          description: Forbidden – insufficient scope
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                      code:
                        type: string
                      message:
                        type: string
                      errors:
                        type: array
                        items: {}
                    required:
                      - type
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '429':
          description: Too Many Requests – rate limit exceeded
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                      code:
                        type: string
                      message:
                        type: string
                      errors:
                        type: array
                        items: {}
                    required:
                      - type
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      type:
                        type: string
                      code:
                        type: string
                      message:
                        type: string
                      errors:
                        type: array
                        items: {}
                    required:
                      - type
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Bearer access token from POST /_api/auth

````