Authentication

Method supports two ways to authenticate requests: API keys and OAuth 2.0 client credentials. Both are sent as a Bearer token in the Authorization header of every request, and both resolve to the same team, so the rest of the API behaves identically.

	API keys	OAuth
Credential	A long-lived secret key (`sk_…`)	A `client_id` and `client_secret` exchanged for a short-lived access token (`oat_…`)
Expiry	Never expires	Access tokens expire after 1 hour
Access	Full access to your team	Constrained to the scopes granted to your client
Setup	Copy the key from the Dashboard	Create a client, then implement the token exchange

Use an API key to get started quickly, or where a single trusted service calls Method. Use OAuth when you want short-lived credentials that expire on their own, or when you want to restrict an integration to a subset of the API.

API keys

An API key identifies your team. Secret API keys have the prefix sk_, and your team has a separate key for each environment. Keys are available under the Keys section in the Method Dashboard, where you can also rotate them. API keys do not expire and carry full access to your team, so treat them as sensitive credentials: store them in a secrets manager, never in client-side code or version control. Get started by creating your account in the Method Dashboard or connect with our team.

OAuth

Method supports OAuth 2.0 Client Credentials as an alternative to API keys. You exchange a client_id and client_secret for a short-lived access token, then use that token on API requests in place of an API key.

Create an OAuth client in the Method Dashboard to get a client_id and client_secret.
Exchange them at POST /oauth/token for an access token, valid for 1 hour.
Call the Method API with Authorization: Bearer <access_token>.
When the token expires, request a new one the same way.

Credentials

Credential	Format	Notes
`client_id`	`ocl_…`	Identifies your integration. Not a secret. Safe to log and reference in support requests.
`client_secret`	`ocs_…`	Shown exactly once at issuance. Store it in a secrets manager. Method cannot retrieve it.

Clients and secrets are managed under the OAuth section in the Method Dashboard, where you can mint new secrets and disable existing ones. Each environment has its own clients and secrets.

If you lose a client_secret, mint a new one from the Dashboard. Method cannot recover the original value.

Getting an access token

Send a POST request to /oauth/token with a application/x-www-form-urlencoded body containing grant_type=client_credentials. Authenticate with your client credentials using either HTTP Basic auth or the request body.

curl https://production.methodfi.com/oauth/token \
  -u "ocl_AbC123:ocs_XYZ456" \
  -d "grant_type=client_credentials"

curl https://production.methodfi.com/oauth/token \
  -d "grant_type=client_credentials" \
  -d "client_id=ocl_AbC123" \
  -d "client_secret=ocs_XYZ456"

HTTP Basic auth is recommended, and is the default for most OAuth client libraries. Use the base URL for your environment.

{
  "access_token": "oat_7Hk94r83482csdcK2mQx9vTz",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "entities:read entities:write accounts:read"
}

Field	Description
`access_token`	The bearer token (`oat_…`). Treat it as a secret.
`token_type`	Always `Bearer`.
`expires_in`	Lifetime in seconds (3600 = 1 hour).
`scope`	Space-delimited scopes this token carries.

Token endpoint errors

The token endpoint uses the standard OAuth error format rather than the Method error envelope.

{ "error": "invalid_client", "error_description": "Client authentication failed." }

HTTP	`error`	Cause
400	`invalid_request`	Missing or malformed parameters, such as an absent `grant_type`.
400	`unsupported_grant_type`	A `grant_type` other than `client_credentials`.
400	`invalid_scope`	Requested scope not granted to your client.
401	`invalid_client`	Client authentication failed.
429	`too_many_requests`	Rate limit exceeded. Retry after the `Retry-After` header.

Scopes

Scopes follow <resource>:<action>, where the action maps to the HTTP method:

HTTP method	Action
`GET`	`read`
`POST`, `PUT`, `PATCH`, `DELETE`	`write`

For example, entities:read allows GET /entities/… and entities:write allows POST /entities. Your client is granted a set of scopes by Method. By default a token carries all of them. To request a token with fewer scopes, pass a space-delimited scope parameter:

curl https://production.methodfi.com/oauth/token \
  -u "ocl_AbC123:ocs_XYZ456" \
  -d "grant_type=client_credentials" \
  -d "scope=entities:read accounts:read"

Requesting a scope your client has not been granted returns 400 invalid_scope.

Calling the API with an access token

Send the access token in the Authorization header. Everything else about the API is unchanged.

curl https://production.methodfi.com/entities \
  -H "Method-Version: 2024-04-04" \
  -H "Authorization: Bearer oat_7Hk94r83482csdcK2mQx9vTz"

Two errors are specific to token-based requests:

401 — the token is missing, invalid, expired, or revoked. Request a new token and retry.
403 with sub_type: INSUFFICIENT_SCOPE — the token does not carry the scope this endpoint requires.

{
  "success": false,
  "data": {
    "error": {
      "type": "INVALID_REQUEST",
      "code": 403,
      "sub_type": "INSUFFICIENT_SCOPE",
      "message": "Your access token is missing the required scope 'entities:write' for POST /entities."
    }
  },
  "message": "Your access token is missing the required scope 'entities:write' for POST /entities."
}

Token lifecycle

Cache the token and reuse it for its full lifetime. Do not request a new token per API call.
Renew shortly before expiry, for example 60 seconds early, to avoid a 401 at the boundary. On an unexpected 401, request a new token once and retry.
There are no refresh tokens. This is by design for the client credentials grant (RFC 6749 §4.4.3). Renewal is the same POST /oauth/token call again.

The token endpoint is rate limited.

Secret rotation

Rotate your client_secret from the Method Dashboard for routine rotation or suspected exposure. Your client_id never changes.

Mint a new secret. Both the new and existing secrets remain valid.
Deploy the new secret on your own schedule, with no downtime.
Disable the old secret once you have confirmed cutover.

If a secret is compromised, disable it immediately.

curl https://production.methodfi.com/accounts \
  -H "Method-Version: 2024-04-04" \
  -H "Authorization: Bearer sk_WyZEWVfTcH7GqmPzUPk65Vjc"

const { Method, Environments } = require('method-node');

const method = new Method({
  apiKey: 'sk_WyZEWVfTcH7GqmPzUPk65Vjc',
  env: Environments.production,
});

const accounts = await method.accounts.list();

from method import Method

method = Method(env='production', api_key='sk_WyZEWVfTcH7GqmPzUPk65Vjc')

accounts = method.accounts.list()

API Reference

Entities

Accounts

Wallet

Payments

Files

Opal

Elements

Events

Supporting Endpoints

API keys

OAuth

Credentials

Getting an access token

Token endpoint errors

Scopes

Calling the API with an access token

Token lifecycle

Secret rotation

​API keys

​OAuth

​Credentials

​Getting an access token

​Token endpoint errors

​Scopes

​Calling the API with an access token

​Token lifecycle

​Secret rotation

API keys

OAuth

Credentials

Getting an access token

Token endpoint errors

Scopes

Calling the API with an access token

Token lifecycle

Secret rotation