M2M Authentication

Machine-to-machine (M2M) authentication is intended for server-to-server integrations that act as a configured Advisor API principal. Your backend exchanges its client_id and client_secret for a short-lived bearer token, then sends that token with supported API requests.

Supported operations

M2M bearer tokens are accepted by the Advisor API v2 top-account APIs and these Advisor API v1 operations:

  • List clients: GET /v1/clients
  • Get a client: GET /v1/clients/{user_wid}
  • Get a client by external id: GET /v1/clients/by-external-id/{external_id}
  • Create, list, get, update, and delete documents beneath either supported client path

Other Advisor API v1 operations do not accept M2M bearer tokens.

For a single-advisor/team principal, Wealth.com uses the advisor and team configured during onboarding when advisor_id and team_id are omitted. A company-wide principal must send both values on each supported v1 request.

Authentication flow

  1. Request a token from POST /v2/auth/token using your client_id and client_secret.
  2. Include the token in the Authorization header of supported requests.
  3. Request a new token before the current token expires.
POSTadvisor-api.wealth.com/v2/auth/token

Generate an auth token

  • Name
    client_id
    Type
    string
    Description

    Your firm's client identifier for API access.

  • Name
    client_secret
    Type
    string
    Description

    Your firm's client secret for API authentication.

Request

POST
advisor-api.wealth.com/v2/auth/token
  curl --location 'https://advisor-api.wealth.com/v2/auth/token' \
    --header 'Content-Type: application/json' \
    --data-raw '{
      "client_id": "your_client_id",
      "client_secret": "your_client_secret"
    }'

Response

  • Name
    access_token
    Type
    string
    Description

    The token to send with supported Advisor API requests.

  • Name
    token_type
    Type
    string
    Description

    Always Bearer.

  • Name
    expiration_date
    Type
    ISO 8601 date-time
    Description

    The timestamp when the token expires.

Response

{
  "access_token": "your_token",
  "token_type": "Bearer",
  "expiration_date": "2026-09-24T16:00:00Z"
}

HTTP status codes

  • Name
    200
    Type
    Description
    Success - Authentication token generated successfully
  • Name
    400
    Type
    Description
    Bad Request - Missing client_id or client_secret
  • Name
    401
    Type
    Description
    Unauthorized - Invalid client credentials
  • Name
    500
    Type
    Description
    Internal Server Error - Token generation failed

Use the token

Send the token using the Bearer scheme:

List clients with an M2M token

curl --location 'https://advisor-api.wealth.com/v1/clients?page=0&page_size=100' \
  --header 'Authorization: Bearer your_token'

An expired or invalid token returns 401 Unauthorized. A valid token used with an unsupported operation returns 403 Forbidden.

Security

  • Keep the client_secret in your backend secret store. Never expose it in browser or mobile application code.
  • Do not log client secrets or access tokens.
  • Use the expiration_date response value to request a replacement token before expiration.