POST
/
api
/
v2
/
auth
/
sandbox
/
token
Authenticate sandbox client
curl --request POST \
  --url https://sandbox.finhub.cloud/api/v2/auth/sandbox/token \
  --header 'Content-Type: application/json' \
  --header 'X-Forwarded-For: <x-forwarded-for>' \
  --data '{
  "username": "<string>",
  "password": "<string>",
  "customerKey": "<string>",
  "customerSecret": "<string>",
  "accountType": "B2B"
}'
{
  "userSessionToken": "<string>",
  "expiresIn": 123,
  "tokenType": "<string>",
  "userId": "<string>",
  "customerId": "<string>",
  "personId": "<string>",
  "tenantId": "<string>",
  "credentials": [
    {
      "sessionId": "<string>",
      "value": "<string>",
      "token": "<string>"
    }
  ],
  "organizationId": "<string>",
  "twoFaInfo": [
    {
      "id": "<string>",
      "createdAt": "<string>",
      "updatedAt": "<string>",
      "tenantId": "<string>",
      "login": true,
      "trading": true,
      "funding": true,
      "userId": "<string>"
    }
  ],
  "isOneTimePasswordLogin": true,
  "isPasswordExpired": true,
  "bffToken": "<string>",
  "oneTimePasswordLogin": true
}

Headers

sec-ch-ua-platform
string

Client platform information

X-Forwarded-For
string
required

Forwarded client IP address

User-Agent
string

Client user agent information

X-Tenant-ID
string

Tenant identifier for multi-tenant operations

Body

application/json

Sandbox login credentials

username
string
required
Minimum length: 1
password
string
required
Minimum length: 1
customerKey
string
required
Minimum length: 1
customerSecret
string
required
Minimum length: 1
accountType
enum<string>
Available options:
B2B,
B2C,
TENANT_USER,
TENANT_ADMIN,
PLATFORM_OWNER_ADMIN,
PT_USER,
PT_ADMIN,
GOD_USER,
DEVELOPER

Response

Authentication successful

userSessionToken
string
expiresIn
integer
tokenType
string
userId
string
customerId
string
personId
string
tenantId
string
credentials
object[]
organizationId
string
twoFaInfo
object[]
isOneTimePasswordLogin
boolean
isPasswordExpired
boolean
bffToken
string
deprecated

Deprecated: Use getUserSessionToken() instead. Will be removed in a future release.

oneTimePasswordLogin
boolean