def get_authenticated_api_session(username, password):
    """
    :return: an authenticated api session
    """
    session = MoJOAuth2Session(
        client=LegacyApplicationClient(
            client_id=settings.API_CLIENT_ID
        )
    )

    session.fetch_token(
        token_url=get_request_token_url(),
        username=username,
        password=password,
        auth=HTTPBasicAuth(settings.API_CLIENT_ID, settings.API_CLIENT_SECRET),
        timeout=15,
        encoding='utf-8'
    )
    return session