Skip to main content
Credit Benchmark
Credit BenchmarkOctober 2, 2026 - 2 min read
API integrations can now authenticate machine-to-machine (M2M): each server or laptop that calls the Credit Benchmark API gets its own identity, and no one has to store or type a password for it to connect.
Enhancement: OAuth 2.0 private key JWT client authentication (RFC 7523)Your machine signs a short-lived client assertion with its ES256 private key and exchanges it at POST /api/security/token for a 30-minute access token. The private key never leaves your machine, and no client secret is ever sent.

​
The problem

Automated integrations used to depend on a username and password stored somewhere a script could read them. Shared credentials are easy to leak, hard to rotate, and impossible to tie to a single machine.

​
What it does

You register a public key with us once. From then on, your machine proves who it is by signing each token request with the matching private key.
  • Key pair - an ES256 (P-256) key pair you generate on the calling machine. Only the public key is sent to us
  • OAuthClientId - identifies your organisation in the signed request
  • KID - identifies which registered public key to check the signature against
  • Client assertion - a signed JWT that is valid for 2 minutes and can be used only once
  • Access token - a 30-minute bearer token for your API calls

​
Use cases

  • Scheduled pipelines - nightly feeds and portfolio refreshes run without a stored password
  • Separate environments - use a different key pair for Sandbox and Production, each with its own identity
  • Key rotation - swap in a new key pair with an overlap period, without changing your OAuthClientId

​
Getting started

  1. Register a key pair - generate an ES256 key pair and send us the public key
  2. Get a token - POST /api/security/token with a signed client assertion
  3. Run the sample scripts in TypeScript or Python to make your first call
Back to all release notes