> ## Documentation Index
> Fetch the complete documentation index at: https://docs.montereyfinancial.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint an access token

> Exchange an API key prefix and plaintext secret for a 3600-second bearer token.



## OpenAPI

````yaml /api-reference/external_api.openapi.json post /v1/oauth/token
openapi: 3.1.0
info:
  title: Monterey Client API
  description: >-
    Org-scoped, token-authenticated account, borrower, and payment endpoints for
    Monterey Financial clients.
  version: 1.0.0
servers:
  - url: https://api.montereyfinancial.app
    description: Production
security:
  - BearerToken: []
tags:
  - name: Authentication
    description: Exchange API keys for access tokens.
  - name: Organizations
    description: Organizations visible to the API key.
  - name: Persons
    description: Borrowers visible through in-scope accounts.
  - name: Accounts
    description: Servicing accounts and identifier lookups.
  - name: Transactions
    description: Account money-movement history.
  - name: Payment Methods
    description: Stored payment instruments.
  - name: Autopay
    description: Recurring payment schedules.
paths:
  /v1/oauth/token:
    post:
      tags:
        - Authentication
      summary: Mint an access token
      description: >-
        Exchange an API key prefix and plaintext secret for a 3600-second bearer
        token.
      operationId: mint_token_v1_oauth_token_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: The request does not use the client_credentials grant.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: The client ID or API key is invalid or cannot mint tokens.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
        '429':
          description: The source IP exceeded the token-exchange rate limit.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RateLimitErrorResponse'
      security: []
components:
  schemas:
    TokenRequest:
      properties:
        grant_type:
          type: string
          title: Grant Type
          description: Must be `client_credentials`.
        client_id:
          type: string
          title: Client Id
          description: API key prefix shown in the client portal.
        client_secret:
          type: string
          title: Client Secret
          description: API key plaintext shown once at creation.
      type: object
      required:
        - grant_type
        - client_id
        - client_secret
      title: TokenRequest
      description: Client-credentials request using a portal-issued API key.
    TokenResponse:
      properties:
        access_token:
          type: string
          title: Access Token
        token_type:
          type: string
          title: Token Type
        expires_in:
          type: integer
          title: Expires In
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      title: TokenResponse
      description: Short-lived bearer token returned by a successful exchange.
    ErrorResponse:
      properties:
        detail:
          $ref: '#/components/schemas/ErrorBody'
      type: object
      required:
        - detail
      title: ErrorResponse
      description: Standard error envelope. Branch on `detail.error_code`.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
      description: >-
        Parameter-validation error (HTTP 422). `detail` lists each violated
        constraint with its location, message, and type.
    RateLimitErrorResponse:
      properties:
        detail:
          $ref: '#/components/schemas/RateLimitErrorBody'
      type: object
      required:
        - detail
      title: RateLimitErrorResponse
      description: Rate-limit error envelope returned with HTTP 429.
    ErrorBody:
      properties:
        error_code:
          type: string
          title: Error Code
      type: object
      required:
        - error_code
      title: ErrorBody
      description: Standard error body. Branch on `error_code`.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
      description: >-
        A single parameter-validation failure: `loc` is the path to the
        offending input, `msg` is human-readable, and `type` is the rule that
        failed.
    RateLimitErrorBody:
      properties:
        error_code:
          type: string
          const: rate_limited
          title: Error Code
        bucket:
          type: string
          enum:
            - api
            - token
          title: Bucket
        limit_per_minute:
          type: integer
          title: Limit Per Minute
        burst_capacity:
          type: integer
          title: Burst Capacity
        retry_after_seconds:
          type: integer
          title: Retry After Seconds
        reset_at:
          anyOf:
            - type: string
            - type: 'null'
          title: Reset At
      type: object
      required:
        - error_code
        - bucket
        - limit_per_minute
        - burst_capacity
        - retry_after_seconds
        - reset_at
      title: RateLimitErrorBody
      description: Self-tuning details returned after a rate-limit denial.
  securitySchemes:
    BearerToken:
      type: http
      description: Short-lived access token minted by POST /v1/oauth/token.
      scheme: bearer
      bearerFormat: JWT

````