> ## Documentation Index
> Fetch the complete documentation index at: https://docs.creditbenchmark.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine-to-Machine Authentication

> Overview of machine-to-machine (M2M) access to the Credit Benchmark API using ES256 key pairs and OAuth 2.0 private key JWT client authentication.

The Credit Benchmark API uses machine-to-machine (M2M) authentication. We register machines, not people. A machine can be a server in your data centre or cloud, or someone's laptop. Each one gets its own identity with us, and no one needs to type a username or password for it to connect.

That identity is a pair of digital keys that you create on the machine:

* The **private key** stays on the machine and proves it is the one making requests.
* The **public key** is the matching half. You send it to us, we register it, and we use it to check that each request really comes from your machine.

Because the private key is never shared, there is no password or shared secret to lose.

> [!NOTE]
>
> The standard behind this is OAuth 2.0 with private key JWT client authentication ([RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523)). Your machine signs a short-lived request with its private key, we check the signature against the public key you registered, and we then issue an access token. Keys use the ES256 algorithm on the P-256 elliptic curve.

## Onboarding at a glance

**1. Generate a key pair**

Create an ES256 key pair on the machine that will call the API. See [Key pair setup](/api-reference/authentication/key-pair-setup).

**2. Send us the public key**

Send only `es256-public.pem`, with the fingerprint and your onboarding details, to your Credit Benchmark contact.

**3. Receive your onboarding pack**

We register the key and send you an onboarding pack with your client details and runnable sample scripts.

**4. Request access tokens**

Your machine signs a short-lived client assertion with its private key and sends it to the token endpoint. We verify the signature against the public key registered under your `KID` and return an access token. See [Request an access token](/api-reference/authentication/request-token).

## What you receive back

Once we have registered your public key, we send you an onboarding pack. It holds three details that turn your key into a working login, plus example scripts in Python and Node.js. None of the details are secret, but keep them with your integration configuration.

| Detail | What it is | Where you use it |
| - | - | - |
| `OAuthClientId` | Your client identifier, a random GUID that names your organisation in our system | The `iss` and `sub` claims of your signed request, and the `OAuthClientId` form field |
| `KID` | The identifier of the public key you sent us, so we know which key to check against | The `kid` header of your signed request |
| Token endpoint | The web address that hands out access tokens | Where you send the token request |

> [!TIP]
>
> The token endpoint is `https://gateway.creditbenchmark.com/api/security/token` and the audience value is `cb-gateway-m2m-blue`. Your onboarding pack includes both.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.