Authentication

All QFAST API requests require a Bearer token obtained via the OAuth2 Client Credentials grant. This is a server-to-server (machine-to-machine) flow — no user login is involved.

Credentials

QFAST provisions a client_id and client_secret for each lender during account setup. Contact the QFAST team to receive yours. Each credential pair is tied to your lender account and must be kept confidential.

1. Obtain an Access Token

Endpoint: POST /v1/oauth2/token

Headers:

Content-Type: application/json
Accept: application/json

Request Body:

{
  "grant_type": "client_credentials",
  "client_id": "<your_client_id>",
  "client_secret": "<your_client_secret>"
}

Field	Type	Required	Description
`grant_type`	String	Yes	Must be `client_credentials`.
`client_id`	UUID	Yes	Your OAuth2 client identifier.
`client_secret`	String	Yes	Your OAuth2 client secret.

Success Response (200 OK)

{
  "token_type": "Bearer",
  "expires_in": 300,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..."
}

Field	Type	Description
`token_type`	String	Always `Bearer`.
`expires_in`	Integer	Token lifetime in seconds. Default: 300 (5 minutes).
`access_token`	String	JWT token. Use this in the `Authorization` header.

No refresh token. Client Credentials grant does not issue a refresh token. Request a new token before the current one expires.

Example

2. Use the Token

Include the access token in every API request:

Authorization: Bearer <access_token>

Example

3. Token Lifecycle

Token expiry is short (5 minutes). Your integration must handle token renewal proactively.

Recommended approach:

Request a token before making API calls.

Cache the token and reuse it until expires_in seconds have elapsed.

When the token is close to expiry (or a 401 is received), request a new one.

Never hardcode tokens — always fetch them programmatically.

4. Error Responses

Token Request Errors

400 Bad Request

{
  "error": "invalid_request",
  "error_description": "Missing required parameter: grant_type",
  "code": 400
}

400 Bad Request (Unsupported Grant Type)

{
  "error": "unsupported_grant_type",
  "error_description": "Grant type must be client_credentials",
  "code": 400
}

401 Unauthorized

{
  "error": "invalid_client",
  "error_description": "Client authentication failed: invalid client_id or client_secret",
  "code": 401
}

HTTP Status	Error	Cause
`400`	`invalid_request`	Missing required parameter.
`400`	`unsupported_grant_type`	Grant type is not `client_credentials`.
`401`	`invalid_client`	Wrong `client_id` or `client_secret`.

API Request Errors

401 Unauthorized

{
  "error": "invalid_token",
  "error_description": "The access token is missing, invalid, or expired.",
  "code": 401
}

403 Forbidden

{
  "error": "forbidden",
  "error_description": "Token is valid but the resource belongs to a different lender.",
  "code": 403
}

HTTP Status	Error	Cause
`401`	`invalid_token`	Missing, invalid, or expired access token.
`403`	`forbidden`	Token is valid but the resource belongs to a different lender.

Credentials#

1. Obtain an Access Token#

Success Response (200 OK)#

Example#

2. Use the Token#

Example#

3. Token Lifecycle#

4. Error Responses#

Token Request Errors#

API Request Errors#

Credentials

1. Obtain an Access Token

Success Response (200 OK)

Example

2. Use the Token

Example

3. Token Lifecycle

4. Error Responses

Token Request Errors

API Request Errors