Authentication

The Bre-B Participant API uses OAuth 2.0 client credentials for authentication. Unlike Banking and Core, which also accept static API keys, Bre-B requires you to exchange a client ID and secret for a short-lived access token, and then attach that token to every API call. The token expires; your code refreshes it automatically before it does.

If you have read api-standards/authentication, this page only adds the Bre-B specifics: the token-exchange endpoint, the token lifetime, and the rotation procedure.

This page is an authentication scaffold. The full version will document the token-exchange request and response, error handling, and recommended client patterns.

Before you start

You need:

A Bre-B participant agreement with Mono.
Client credentials (client ID and client secret) issued by Mono for your tenant.
The participant base URL for your environment (sandbox or production).

Token exchange

The full token-exchange request, response, and refresh strategy will be documented here. See Bre-B Participant authentication API reference for the endpoint contract.

Sending the token

Authorization: Bearer <your_access_token>

Scopes

A scope is a single permission attached to an access token. Request the narrowest scopes your integration needs, separated by spaces in the token request. Each resource has two scopes:

The bare scope, such as collections, grants every action on that resource.
The :readonly scope grants reads only.

Scope	Grants
`outgoing_transfers`	All permissions for outgoing transfers
`outgoing_transfers:readonly`	Read outgoing transfers
`target_resolutions`	Resolve Bre-B keys and read their resolutions
`target_resolutions:readonly`	Read target resolutions
`target_discoveries`	Discover Bre-B keys and read the bank catalog
`target_discoveries:readonly`	Read the bank catalog
`collections`	All permissions for collections
`collections:readonly`	Read collections
`tenant_accounts`	All permissions for tenant accounts
`tenant_accounts:readonly`	Read tenant accounts

A Bre-B key is an alias, such as a phone number, that points to a bank account.

Target discovery scopes

Use target_discoveries to find a beneficiary's Bre-B key from their identity and bank-account data, when you do not know the exact key. Use target_resolutions when you already know the key and call POST /api/v1/targets/resolve, and outgoing_transfers when you create the payment. See the target discovery flow for the complete sequence.

Failures

Status	Meaning
`401 Unauthorized`	Token missing, expired, or revoked — refresh it.
`403 Forbidden`	Token valid but lacks the scope for this endpoint.

Rotating credentials

Tokens expire automatically; rotation in the operational sense means rotating the client secret used to obtain them. Rotate the client secret at least every 90 days and immediately after any suspected exposure.