Skip to main content
Thred uses a two-tier OAuth2 system for secure multi-tenant access.

Partner-Scoped Token

Backend onlyManage multiple businesses:
  • List all businesses
  • Create new businesses
  • Get business-scoped tokens

Business-Scoped Token

Frontend safeAccess single business:
  • Invoices and payments
  • Reports and GL
  • Isolated to one business
Security: Never use partner-scoped tokens on the frontendPartner-scoped tokens grant access to ALL businesses under your partnership. Exposing them in frontend code allows users to access other businesses’ financial data.Always use business-scoped tokens in the frontend - they’re scoped to a single business and safe for end users.

Get Partner-Scoped Token

Exchange your credentials for a partner-scoped token:
Response:

Get Business-Scoped Token

Exchange partner-scoped token for business-scoped token:
Response:

Token Usage

Use for managing businesses:Location: Backend server only

Token Lifecycle

1

Tokens expire after 1 hour

Both token types expire after 3600 seconds.
2

Handle expiration

When you receive 401 Unauthorized:
  • Re-authenticate to get fresh token
  • Retry the failed request
3

Best practice

Cache tokens and refresh before expiry to avoid disruptions.

Security Best Practices

Store partner UUID and API key securely:
  • Environment variables
  • Secrets manager (AWS Secrets Manager, HashiCorp Vault)
  • Never commit to source control
All API calls must use HTTPS. HTTP requests will be rejected.
Request a new API key from Thred at partners@thredfi.com every 90 days for security hygiene. Development and production keys are issued separately, so rotate each one.

Tokens secured. Now embed the accounting UI in your platform.