Authentication

If you have your own application developed for your users, it is likely that you would already have your own authentication system in place. Having users to register an account on your application, then again on Ares for the KYC on-boarding can be an awkward process for the users. The aim of the Integrated Authentication Workflow is to reduce friction by allowing users who already have an account in your application to start the KYC on-boarding process on Ares without having to authenticate themselves again.

How to Request an Access Token

To start using Cynopsis APIs (Ares or Artemis), you must first obtain an access token from the CRM using your issued client_id and client_secret credentials via the OAuth 2.0 client_credentials grant flow.

Below you will find ready-to-use code examples and tables of request parameters for both Demo and Production environments. You can try executing the code samples interactively in Mintlify by using the “Run” / “Copy” buttons.

Request Parameters

CRM Access Token Endpoints

Environment	URL
Demo	https://crm-demo.cynopsis.co/oauth/token
Production	https://crm.cynopsis.co/oauth/token

POST /oauth/token
Host: crm-demo.cynopsis.co or crm.cynopsis.co
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
client_id=your_client_id
client_secret=your_secret_key

Replace the values as follows:

• client_id: Your assigned client ID from Cynopsis
• client_secret: Your assigned client secret from Cynopsis
• Select the Demo or Production URL as appropriate.

Sample Access Token Response

A successful request will return a response similar to this:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs...",
  "expires_in": 28800,
  "token_type": "Bearer"
}

• access_token: The string to be used in API requests as a Bearer token in the Authorization header.
• expires_in: Validity of the token in seconds (typically 8 hours).
• token_type: Always Bearer.

---

How to Use the Access Token

After obtaining the token, add it to the Authorization header for all subsequent API calls:

Authorization: Bearer <access_token>