morningstar.com

Request access to Direct Web Services via Morningstar Contact Us or through your Morningstar account representative. Once your licensed account is provisioned, use the issued username and password to call the Authentication API and mint bearer tokens.

Use your Direct Web Services account credentials to POST to /token/oauth on your regional base URL (for example https://www.us-api.morningstar.com/token/oauth) with Authorization: Basic {Base64(username:password)} as described in the Authentication API overview. The response contains access_token, which you send as Authorization: Bearer {access_token} on subsequent API calls. Tokens are valid for 60 minutes.

Point your MCP client at the server URL and approve access in the browser. The server accepts a Client ID Metadata Document (CIMD), so the client authenticates with its own hosted URL as the client_id — nothing to register.

After receiving your DBRS client identifier and client secret, call GET https://api.dbrs.io/auth/v1/token with headers x-clientid and x-clientsecret as shown in the DBRS Developer Portal. The auth service returns a JWT token, which the portal says is required for access to the vast majority of service endpoints.