---
title: "Authentication"
url: "https://docs.wayflyer.com/embedded-journey-v5-overview/shared/authentication"
image: "https://docs.wayflyer.com/_og/d/c_Ocean.takumi,title_Authentication,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMyMzIzMmQifX19,p_Ii9lbWJlZGRlZC1qb3VybmV5LXY1LW92ZXJ2aWV3L3NoYXJlZC9hdXRoZW50aWNhdGlvbiI,s_sa604vQ4gaqYKxDI.png"
---

## Authentication

Learn how to authenticate calls to the Embedded Finance API

## [Client ID and Client Secret](#client-id-and-client-secret)

During onboarding your Wayflyer rep will have provided you with a pair of credentials i.e., a `client_id` and a `client_secret`.

**These should not be exposed in your front end. If they are, contact us immediately.**

These can be exchanged for a Partner Token, which can then be exchanged for a Company Token. Some endpoints require a Partner Token and some require a Company Token. These are both JWTs and should be injected in to the headers of HTTP calls to these endponts as Bearer tokens e.g.,

```text
Authorization: Bearer <Partner Token | Company Token>
```

## [Partner Tokens](#partner-tokens)

Some endpoints perform an action on behalf of a partner. These require a Partner Token.

To acquire a Partner Token, the partner's backend system should make a `POST` request to `https://api.wayflyer.com/financing/v1/partner-token/` using the provided `client_id` and `client_secret`. The Partner Token is valid for 24 hours and should be securely cached and re-used until it expires.

The request payload must be structured as follows:

```json
{
  "partner_id": "your-client-id",
  "partner_secret": "your-client-secret"
}
```

The response will contain the Partner Token:

```json
{
  "token": "Partner_Token",
  "expires_in": 86000
}
```

## [Company Tokens](#company-tokens)

Some endpoints performan actions on behalf of a company. These require a Company Token.

To acquire a Company Token, the partner's backend must make a request to `https://api.wayflyer.com/financing/v1/partner/company-token/` using the Partner Token as a bearer token authentication. The Company Token is valid for 24 hours and should be cached and re-used until it expires. **It should only be used to perform actions for the company on whose behalf it was minted.**

The request should include an anonymous ID for the user the partner is minting the company token for. It's important that this token is both anonymous and consistent i.e., doesn't change between user sessions.

The request payload must be structured as follows:

```json
{
  "company_id": "some-string-id",
  "user_id": "some-user-id"
}
```

The `company_id` parameter is a string that identifies a given company on your platform without revealing their public identity. You may choose how to map your companies to these IDs, but they must meet the following restrictions:

-   The ID must be provided as a string value.
-   The ID cannot exceed a length of 255 characters.
-   The ID must be unique per company.
-   The ID must not be something that could be used to reveal a company's identity without their explicit consent.

This call will return a Company Token, which must be supplied to the Wayflyer SDK:

```json
{
  "token": "Company_Token",
  "expires_in": 86000
}
```