> ## Documentation Index
> Fetch the complete documentation index at: https://docs.svrn.digital/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange client credentials for a bearer token

> The live implementation expects client credentials in headers, not in a JSON body.



## OpenAPI

````yaml /contracts/svrn-integration-api.json post /auth
openapi: 3.0.3
info:
  title: SVRN Sequential Client API
  version: '2026-04-27'
  description: >-
    OpenAPI spec generated from scripts/dux_requests and the current Lambda
    handlers. This reflects the real sequential client flow used by DUX and
    corrects the main mismatches in the published docs: POST /auth authenticates
    with X-Client-Id and X-Client-Secret headers, POST
    /onboarding/{customer_id}/create-bank-account is the active bank-account
    route, POST /due-diligence/init returns a due_diligence_id plus
    contracts_preview while upload URLs are requested separately via POST
    /due-diligence/{due_diligence_id}/uploads, and due diligence signature
    confirmation is not a client API step because it is performed by the signer
    through an emailed link outside the integrator flow.
servers:
  - url: https://api.sandbox.svrn.digital
    description: Sandbox
  - url: https://api.svrn.digital
    description: Production
security:
  - bearerAuth: []
tags:
  - name: 01 Authentication
    description: Bearer token issuance for client integrations.
  - name: 02 Onboarding
    description: >-
      Customer onboarding, listing, verification resumption, and artist PIX
      registration.
  - name: 03 Due Diligence
    description: >-
      Case creation, file upload URL issuance, offer publication, and status
      polling. Signature confirmation happens out-of-band through emailed links.
  - name: 04 Reconciliation
    description: >-
      Contract reconciliation initialization, file upload URL issuance, and
      settlement tracking.
paths:
  /auth:
    post:
      tags:
        - 01 Authentication
      summary: Exchange client credentials for a bearer token
      description: >-
        The live implementation expects client credentials in headers, not in a
        JSON body.
      operationId: exchangeClientCredentials
      parameters:
        - name: X-Client-Id
          in: header
          required: true
          description: Partner or client identifier issued by SVRN.
          schema:
            type: string
            format: uuid
        - name: X-Client-Secret
          in: header
          required: true
          description: Client secret issued by SVRN.
          schema:
            type: string
      responses:
        '200':
          description: JWT issued successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthTokenResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/ServerError'
      security: []
components:
  schemas:
    AuthTokenResponse:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
        token_type:
          type: string
          enum:
            - Bearer
        expires_in:
          type: integer
          example: 10800
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: string
        message:
          type: string
      example:
        error: MISSING_FIELD
        message: artist.customer_id is required
  responses:
    Unauthorized:
      description: Authentication failed or credentials are missing.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: The authenticated client cannot access this resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.