Fingoal Authentication

generated: '2026-07-19'
method: searched
source: openapi/fingoal-insights-openapi-original.json
docs: https://docs.fingoal.dev/
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
notes: >-
  The Insights API is declared as OAuth2 clientCredentials in the OpenAPI, but
  the token is minted by a custom endpoint: POST
  https://findmoney.fingoal.com/v3/authentication with a JSON body
  {"client_id","client_secret"} returns a JWT `access_token`. That JWT is then
  sent as `Authorization: Bearer <token>` on every request. Developer
  credentials are issued on request (24h turnaround) via
  https://fingoal.com/request-developer-account - there is no public self-serve
  signup. Dev credentials target the findmoney-dev host; production the
  findmoney host.
schemes:
- name: Authentication
  type: oauth2
  api: fingoal:fingoal-enrichment-api
  flows:
  - flow: clientCredentials
    tokenUrl: https://findmoney.fingoal.com/v3/authentication
    scopes: 1
  sources:
  - openapi/fingoal-insights-openapi-original.json
- name: BearerAuth
  type: oauth2
  api: fingoal:fingoal-link-money-api
  flows:
  - flow: clientCredentials
    tokenUrl: https://link-money-dev.fingoal.dev/api/oauth/token
    scopes: 1
    scope_names:
    - tenantId
  sources:
  - openapi/_original/fingoal-link-money-openapi-original.json
  notes: >-
    Link Money declares oauth2 clientCredentials but is not RFC 6749 shaped. POST
    /api/oauth/token takes a JSON body of CAMEL-cased {clientId, clientSecret,
    tenantId} and returns {token} - not {access_token, token_type, expires_in}.
    The single declared "scope" is tenantId, which is really a tenancy selector:
    the JWT is valid for 1 hour and grants access to exactly one tenant, so
    multi-tenant integrations must mint one token per tenant. Send it as
    Authorization: Bearer <token>. Tenant access itself is granted out of band -
    email support@fingoal.com; clients cannot create tenants.