MTI uses OAuth 2.0 client credentials. You exchange a client ID and client secret for an access token, and send that token as a bearer token on every request. There is no API key, and there is no username and password.This is a deliberate difference from the rest of the portfolio. MTI is built to deploy into zero trust environments where a long lived key in a database is not acceptable, so roles and scopes travel inside the token itself.
This page is a draft
The MTI authentication details are published here ahead of review by the MTI product team, and the token endpoint currently configured for Try It points at a staging realm. Confirm the production token endpoint with your Pole Star representative before you build against it.
Post your client ID and secret to the token endpoint.
The response carries an access_token and the number of seconds until it expires. Scopes come from the client we issue you, so there is nothing to request in the call.
Put the token in an Authorization header on every request.
All requests must be made over HTTPS. Requests over HTTP are not processed.
Cache the token, do not fetch one per call
Access tokens are short lived but they are not single use. Fetch one, hold it until it is close to expiry, then fetch another. A token exchange on every API call doubles your request count for nothing.
Your token must carry the mti:api scope. We grant it to the client we issue you, so if the scope is missing it is a provisioning problem and not something you can fix in the request.
Symptom
Likely cause
Fix
401 Unauthorized
No token, a malformed token, or an expired one
Fetch a fresh token and retry
403 Forbidden
The token is valid but does not carry mti:api
Contact your representative; the client needs the scope granting
429 Too Many Requests
You are over the rate limit for this token
Back off and retry. Batch endpoints exist so you do not have to loop
Client credentials are issued by your Pole Star representative as part of onboarding. There is no self-service portal. If you need them rotated, contact your representative.Read the secret from a secrets manager or an environment variable. It is a long lived credential and it should never reach your source control or your logs.
An Insights key will not work here, and MTI credentials will not work against Insights. If you integrate with both, you hold two sets of credentials and two token flows.
