---
title: "Create OAuth Token"
method: POST
path: "/pl/standard/user/oauth/authorize"
tags: ["Authorize"]
---

# Create OAuth Token

`POST /pl/standard/user/oauth/authorize`

## Request

- Base URL: `https://secure.payu.com`
- URL: `https://secure.payu.com/pl/standard/user/oauth/authorize`
- Auth: none required
- TypeScript: <https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/docs/pl/standard/user/oauth/authorize/post.ts> (a function with typed inputs; its response is checked against the schema)

Each payment should be authorized in one of three available modes: 
- <code>client_credentials</code> - used for standard integration,
- <code>trusted_merchant</code> - used for authentication of requests made for logged-in shop/application users with fixed <code>extCustomerId</code>,
- <code>partner</code> - special type of a token meant for creating entities (e.g. Shop, POS, URL) within partner firm.

Generated access token is valid for 43199 seconds.

## Request body `application/x-www-form-urlencoded`

- union
  - ClientCredentials
    - `grant_type` 'client_credenitals', required: Authorization mode
    - `client_id` string, required: Merchant's POS identifier in PayU's system. Can be found in PayU's merchant panel
    - `client_secret` string, required: Merchant's secret key. Can be found in PayU's merchant panel
  - TrustedMerchant
    - `grant_type` 'trusted_merchant', required: Authorization mode
    - `client_id` string, required: Merchant's POS identifier in PayU's system. Can be found in PayU's merchant panel
    - `client_secret` string, required: Merchant's secret key. Can be found in PayU's merchant panel
    - `email` string, required: Customer's email address in merchant's system
    - `ext_customer_id` string, required: Customer's identifier in the merchant's system
  - Partner: only usable with special Technical Partner priviliges that allow management of Firms, URLs, Shops and POSes created and managed by Partner
    - `grant_type` 'partner', required: Authorization mode
    - `client_id` string, required: Partners client_id
    - `client_secret` string, required: Partners client_secret
    - `firm_id` string, required: publicFirmId created by Partner that will be managed

## Response `200`

- object
  - `access_token` string, uuid: Token used for authentication of API calls.
  - `token_type` 'bearer'
  - `refresh_token` string, uuid
  - `expires_in` 43199: Token expiration time (in seconds).
  - `grant_type` 'client_credentials' | 'trusted_merchant': Token authentication mode.

## Other responses

- `400`
- `401`

---

[API](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api.md) - [All operations](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/revisions/185e74d5e007?raw)