Create participant token

POST
/provider-participant-token

Issue a session token for one of your participants. The Moov Money SDK uses this token to call the send-side API as the participant.

Two ways to call. With an API key: supply the participant’s externalID in the body. With a participant login: send no body, and the participant is resolved from your login.

Only active participants can obtain a token. Participants in pending, denied, or disabled status return 403.

The response is always served with Cache-Control: no-store and Pragma: no-cache.

Auth: API key or participant login.

Request
cURL
curl -X POST https://api.moov.money/provider-participant-token \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00" \
  -H "Content-Type: application/json" \
  -d '{
  "clientType": "device",
  "externalID": "customer-abc-123"
}'
Responses
200 400 401 403 404
The request completed successfully.
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
  "expires_in": 3600,
  "token_type": "bearer"
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request or idempotency-key-reused). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Request

application/json
Body for POST /provider-participant-token. externalID is required with an API key and unused with a participant login. clientType defaults to web when omitted.

externalID

string
Your identifier for the participant. Required with an API key; unused with a participant login.

clientType

string<enum>
Kind of client the token is for. Defaults to web when omitted.
Possible values: web, device, service

Response

The issued session token. Field names are snake_case, matching the OAuth2 token response shape.

access_token

string required
Access token.

refresh_token

string required
Single-use refresh token. The SDK exchanges it for a new access token before the current one expires. Each exchange returns a replacement refresh token and invalidates the previous one. Always store the token from the latest response.

token_type

string required
Token type (typically bearer).

expires_in

integer<int64> required
Seconds until the access token expires.