Issue bearer token

post deprecated

https://api.lendingwise.com/api/v4/authenticate

Swap your client_id and client_secret for a bearer token — the
credential you send with every other call in this API. The token
belongs to one processing company, which is what keeps every read and
write inside your own company's data.

You can send the credentials as JSON or as ordinary form fields.
Both are accepted.

A token lasts 72 hours (259200 seconds). Ask for a shorter one by
sending expire with a number of seconds between 1 and 259200 — 72
hours is both the default and the longest a token can last, so
expire can only make it shorter, never longer. Ask for a fresh
token, or call POST /api/v4/refresh, before the one you hold runs
out; otherwise a long-running job starts getting 401 replies
part-way through.

Only client credentials are accepted here. If you send grant_type
it has to be client_credentials. code and redirect_uri are not
accepted at all — sending either one is refused with 422.

Deprecated. This way of signing in is being replaced. For a new integration, ask LendingWise support for a Sanctum API key for your processing company instead: an API key does not expire, so there is no refresh to run. Tokens issued here still work, and a reply to a call that used one carries the Deprecation, Warning and Link headers described in RFC 8594. No retirement date has been set.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Your client id and secret. Send them as JSON or as form fields — both work.

client_id

string

required

Your client id, which LendingWise support sets up for you. It belongs to one processing company, and that is the company whose data the token you get back can read and write.

client_secret

string

required

The secret that goes with your client_id. Treat it exactly as you would a password: keep it in a secret manager, keep it out of your logs, and never put it in code that runs in a browser or a mobile app.

grant_type

string | null

enum

Optional. Client credentials are the only way to sign in here, so the one value this accepts is client_credentials. Leave it out, or send null, to get the same result. Any other value is refused with a 422.

Allowed:

expire

integer

1 to 259200

How long you want the token to last, in seconds, from 1 to 259200. Leave it out and you get 259200 seconds (72 hours), which is also the longest a token can last — so this can only make a token shorter-lived, never longer. A short one suits a script that does one job and stops, where the token has no reason to outlive the run.

Headers

content-type

string

enum

Defaults to application/json

Generated from available request content types

Allowed:

Responses

200Your new bearer token, and how long it lasts.

400Your request body could not be read, so nothing was changed. error.details.reason says what the problem was.

401Your bearer token is missing, or it is not valid. Get a new one from POST /api/v4/authenticate and send it again.

415Your body is JSON, but it was not labelled as JSON, so it was not read and nothing was changed. Send it again with Content-Type: application/json.

422One or more of the values you sent cannot be used, so nothing was changed. error.fields names each field and says what was wrong.

429You have made too many calls, so this one was refused and nothing was changed. Retry-After says how many seconds to wait; sending the same request again after that works.

defaultAny other failure. The shape is the same as every other error reply, so the same code can read it.