> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yourflexpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How applications authenticate and call protected IDaaS endpoints.

# Authentication

Most IDaaS endpoints require an application-scoped Bearer token.

## Token exchange

`POST /v1/auth/token` exchanges your `clientId` and `clientSecret` for a JWT.

### JSON request

```bash theme={null}
curl -X POST https://staging-idaas.yourflexpay.com/api/v1/auth/token \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "<clientId>",
    "client_secret": "<clientSecret>"
  }'
```

### Form request

```bash theme={null}
curl -X POST https://staging-idaas.yourflexpay.com/api/v1/auth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id=<clientId>' \
  --data-urlencode 'client_secret=<clientSecret>'
```

## Using the token

```text theme={null}
Authorization: Bearer <token>
```

Use the token on protected endpoints such as:

* `POST /v1/subjects`
* `POST /v1/tags`
* `POST /v1/transactions`
* `GET /v1/wallet`

## Public endpoints

These endpoints do not require prior authentication:

* `POST /v1/applications`
* `POST /v1/auth/token`
* `GET /v1/tags/{tag}`
* `GET /v1/consent/**`

## Operational guidance

* Treat `clientSecret` as a long-lived credential.
* Rotate compromised credentials immediately.
* Cache the JWT only until it expires.
* Never expose application secrets in client-side code.