> ## Documentation Index
> Fetch the complete documentation index at: https://docs.creditbenchmark.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introducing Machine-to-Machine Authentication

> An enhancement to API security: integrations now authenticate with an ES256 key pair and short-lived signed assertions, so no password or shared secret is ever sent.

![Credit Benchmark](https://mintcdn.com/creditbenchmark/MBcrXm7PNn_QJihI/images/blog/03_CB_Symbol_Down_SG_pos_RGB.png?fit=max\&auto=format\&n=MBcrXm7PNn_QJihI\&q=85\&s=3390b8615aa74c3c052766dc5ca17bce)

Credit Benchmark
October 2, 2026 - 2 min read

API integrations can now authenticate machine-to-machine (M2M): each server or laptop that calls the Credit Benchmark API gets its own identity, and no one has to store or type a password for it to connect.

> [!TIP]
>
> **Enhancement:** OAuth 2.0 private key JWT client authentication ([RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523))
>
> Your machine signs a short-lived client assertion with its ES256 private key and exchanges it at `POST /api/security/token` for a 30-minute access token. The private key never leaves your machine, and no client secret is ever sent.

## The problem

Automated integrations used to depend on a username and password stored somewhere a script could read them. Shared credentials are easy to leak, hard to rotate, and impossible to tie to a single machine.

## What it does

You register a public key with us once. From then on, your machine proves who it is by signing each token request with the matching private key.

* **Key pair** - an ES256 (P-256) key pair you generate on the calling machine. Only the public key is sent to us
* **`OAuthClientId`** - identifies your organisation in the signed request
* **`KID`** - identifies which registered public key to check the signature against
* **Client assertion** - a signed JWT that is valid for 2 minutes and can be used only once
* **Access token** - a 30-minute bearer token for your API calls

## Use cases

* **Scheduled pipelines** - nightly feeds and portfolio refreshes run without a stored password
* **Separate environments** - use a different key pair for Sandbox and Production, each with its own identity
* **Key rotation** - swap in a new key pair with an overlap period, without changing your `OAuthClientId`

## Getting started

1. Register a key pair - [generate an ES256 key pair](https://docs.creditbenchmark.com/api-reference/authentication/key-pair-setup.md) and send us the public key
2. Get a token - [`POST /api/security/token`](https://docs.creditbenchmark.com/api-reference/authentication/request-token) with a signed client assertion
3. Run the [sample scripts](https://docs.creditbenchmark.com/api-reference/authentication/sample-scripts.md) in TypeScript or Python to make your first call

***

[Back to all release notes](https://docs.creditbenchmark.com/product-updates.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.