> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.monite.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.monite.com/_mcp/server.

# Step 2: Implement server side

## Overview

No matter what integration type you will choose for your [Client-side implementation](./client-side/index), there are some certain steps that can be only implemented on your backend. Please note that this tutorial shows code snippets for each step in JSON, while the exact implementation depends on the programming language and framework you use for your server side.

> **Tip**
>
> If for some reason you are not able to follow the steps below at this moment, you can try the same functionality using our [Entities and entity users](https://www.postman.com/monite/workspace/monite-public-workspace/collection/19470609-0a774332-56aa-425c-a2e7-d2f20ee36ab6) Postman collection.

## Before you begin

Before proceeding with this tutorial, make sure you completed the steps in the [Step 1: Get your credentials](credentials) guide and are able to generate a [partner access token](credentials#generate-partner-token).

## 1. Generate a partner access token \[#generate-partner-access-token]

All API calls coming from your backend should be authenticated with a token of `grant_type`: `client_credentials`, which is called a "partner access token". You already learned how to generate this token in the previous tutorial, and now you need to create a token generation function on your backend that will do the following:

```sh
curl -X POST 'https://api.sandbox.monite.com/v1/auth/token' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'Content-Type: application/json' \
     -d '{
        "grant_type": "client_credentials",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET"
     }'
```

> **Error**
>
> Never store your client secret in plain text. Always treat it in a way you treat any other passwords and API keys in your system, and use a special encrypted storage for this type of sensitive data.

The successful response contains the token and its validity time (in seconds):

```json
{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhb...",
  "token_type": "Bearer",
  "expires_in": 1800
}
```

You will need this token to authorize your other API calls later in this tutorial.

## 2. Handle token expiration \[#token-expiration]

A partner token is valid only for 1800 seconds (30 minutes). If you will make a request with an expired token, Monite responds back with a `400 Bad Request` error:

```json
{
  "error": {
    "message": "The token has been expired."
  }
}
```

On your server-side code, implement a mechanism to handle this error and generate a new token, in the same way as you did in the previous step.

## 3. Create an entity \[#create-entity]

For each customer you have in your product, you need to create the corresponding entity in Monite. Here, you do not need to duplicate all the information you already have about your customers – submit only what is required by Monite. For more information about entities, refer to [Monite account structure](../intro/account-structure).

To create an entity, call `POST /entities` and provide the entity details:

```sh
curl -X POST 'https://api.sandbox.monite.com/v1/entities' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '{
    "type" : "organization",
    "email": "info@example.com",
    "address": {
        "city": "Berlin",
        "country": "DE",
        "line1": "Flughafenstrasse 52",
        "postal_code": "10115",
        "state": "BE"
    },
    "organization" : {
        "legal_name" : "Dare - Cronin"
    }
}'
```

The successful response returns information about the created entity including its unique ID.

## 4. Update an entity \[#update-entity]

It is important that you keep this customer information in sync with what you store as an entity on the Monite side. Therefore, in your server-side code, implement a function to update an existing entity, when needed.

To do this, send a `PATCH` request to the `/entities/{entity_id}` endpoint as shown below:

```sh
curl -X PATCH 'https://api.sandbox.monite.com/v1/entities/e39f87be-d499-411b-be6d-a806c500c139' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -d '{
       "organization" : {
         "legal_name" : "Dare Cronin Gmbh."
       }
     }'
```

The successful response returns an updated object containing all details about the entity.

> **Note**
>
> There are many more things you can and might need to do with entities, however these are not in scope of the current tutorial. For more information, refer to [Entities](../entities/index).

## 5. Create an entity user role \[#create-role]

Each entity can have one or more users enabled to perform various operations on the Monite platform. Before creating them, you need to define one or more roles and permissions associated with these roles. For more details on the RBAC system used at Monite and some real-life examples of entity user roles, refer to [Monite account structure](../intro/account-structure).

To create a role, call `POST /roles` and specify the role name and permissions:

```sh
curl -X POST 'https://api.sandbox.monite.com/v1/roles' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'X-Monite-Entity-Id: ENTITY_ID' \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '
     {
      "name": "Basic role",
      "permissions": {
        "objects": [
          {
            "object_type": "entity_user",
            "actions": [
              {
                "action_name": "read",
                "permission": "allowed"
              },
              {
                "action_name": "create",
                "permission": "allowed"
              }
            ]
          },
          {
            "object_type": "payable",
            "actions": [
              {
                "action_name": "create",
                "permission": "allowed"
              },
              {
                "action_name": "read",
                "permission": "allowed_for_own"
              }
            ]
          },
          {
            "object_type": "receivable",
            "actions": [
              {
                "action_name": "create",
                "permission": "allowed"
              },
              {
                "action_name": "read",
                "permission": "allowed_for_own"
              }
            ]
          }
        ]
      }
    }'
```

The successful response returns information about the created user role including its unique ID.

## 6. Create an entity user \[#create-entity-user]

To create an entity user, call `POST /entity_users` with the following request body. The `role_id` field must be populated with the ID of the role created earlier:

```sh
curl -X POST 'https://api.sandbox.monite.com/v1/entity_users' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'X-Monite-Entity-Id: ENTITY_ID' \
     -H 'Authorization: Bearer YOUR_PARTNER_TOKEN' \
     -H 'Content-Type: application/json' \
     -d '{
       "login": "Gardner.Waelchi",
       "first_name": "Gardner",
       "last_name": "Waelchi",
       "role_id": "946141f3-ca01-44dc-b1a6-1024aa71f978",
       "email": "g.waelchi@example.com",
       "phone": "+15551234567",
       "title": "Mr."
     }'
```

The successful request returns information about the created entity user.

## 7. Update an entity user \[#update-entity-user]

Similar to entities, you need to make sure that entity user information is always in sync with what you store on the Monite side. Therefore, in your server-side code, implement a function to update an existing entity user, when needed.

To do this, send a `PATCH` request to the `/entity_users/{entity_id}` endpoint as shown below:

```sh
curl -X PATCH 'https://api.sandbox.monite.com/v1/entity_users/da2a21c7-ed54-4b1e-a8b8-8048588328f5' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer ACCESS_TOKEN' \
     -H 'Content-Type: application/json'
     -d '{
       "first_name": "TestName"
     }'
```

The successful response returns an updated object containing all details about the entity user.

## 8. Generate an entity-user token \[#generate-entity-user-token]

Every time an entity user logs into you application, you also need to issue an individual token for this entity user on the Monite platform. This token will be required for you in the next step, when implementing the client-side integration.

To generate an entity user token, call `POST /auth/token` with the `grant_type` set to `entity_user`, and specify the ID of this user in the `entity_user_id` request field:

```sh
curl -X POST 'https://api.sandbox.monite.com/v1/auth/token' \
     -H 'X-Monite-Version: 2024-05-25' \
     -H 'Content-Type: application/json' \
     -d '{
        "grant_type": "entity_user",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET"
        "entity_user_id": "e7525084....fd94153226fb781"
     }'
```

A successful `200 OK` response contains the entity user-level `access_token` and its validity time (in seconds).

## Next steps

You have now built all the required components of your server-side implementation. Next, you need to choose with client-side components you need to use to embed AP and AR products into your application:

* [Step 3: Implement client side](client-side/index)