Create provider participant token

POST
/provider-participant-token

Issue a session token for one of your participants. The Moov Money SDK uses this token to call the send-side API as the participant.

Two ways to call. With an API key: supply the participant’s externalID in the body. With a participant login: send no body, and the participant is resolved from your login.

Only active participants can obtain a token. Participants in pending, denied, or disabled status return 403.

The response is always served with Cache-Control: no-store and Pragma: no-cache.

Auth: API key or participant login.

Request
cURL
curl -X POST https://api.moov.money/provider-participant-token \
  -H "Content-Type: application/json" \
  -d '{
  "clientType": "device",
  "externalID": "customer-abc-123"
}'
Responses
200 400 401 403 404
The request completed successfully.
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
  "expires_in": 3600,
  "token_type": "bearer"
}
Malformed request: the body or headers failed validation.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.07.00). When omitted, the server applies its default version.

Request

application/json
Body for POST /provider-participant-token. externalID is required with an API key and unused with a participant login. clientType defaults to web when omitted.

clientType

string<enum>
Kind of client the token is for. Defaults to web when omitted.
Possible values: web, device, service

externalID

string
Your identifier for the participant. Required with an API key; unused with a participant login.

Response

The issued session token. Field names are snake_case, matching the OAuth2 token response shape.

token_type

string required
Token type (typically bearer).

expires_in

integer<int64> required
Seconds until the access token expires.

access_token

string required
Access token.