Skip to main content

Security and authentication

CFO uses OAuth 2.0 Client Credentials for machine-to-machine integration. This documentation is read-only and never accepts credentials or tokens.

POST ${CFO_BASE_URL}/integrations/oauth/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic ${BASE64_CLIENT_ID_AND_SECRET}

grant_type=client_credentials

Tokens last 15 minutes and belong only in process memory. Reuse a valid token until shortly before expiry. After a resource 401, invalidate it, obtain a new token, and retry the same request once.

  • Store client_secret in the ERP secret store or a permission-restricted file.
  • Never persist secrets, access tokens, Authorization headers, or cookies in outboxes, logs, or evidence.
  • Secret rotation must not change durable business identities.
  • On token 429, honor Retry-After and use bounded backoff; never retry forever.
  • On 401 invalid_client, stop and ask the CFO operator to verify lifecycle state.

Support evidence should contain the time, zone, non-secret client ID, correlation ID, job ID, and sanitized error code—never the credential itself.