OAuth2

Rotate token credential

Generates a new token credential value and resets the expiration. The authorization grant (GRANTED status) is preserved. Only the ISV that owns the token can rotate it.

post/oauth2/tokens/{token}/rotate

Request

  • Base URL: https://api.payware.eu
  • URL: https://api.payware.eu/oauth2/tokens/{token}/rotate
  • Auth: HTTP bearer

Path parameters

tokenstring required

Response

Token rotated successfully

clientIdstring

The merchant's partnerId

accessTokenstring

The access token

tokenTypestring

Token type. Only "bearer" is supported.

expiresIninteger nullable

Seconds until this token credential stops being accepted, per the OAuth2 meaning of expires_in. A credential requested with POST /oauth2/tokens expires 180 days (by default) after the merchant grants authorization, and a rotated one 180 days after the rotation. NULL means the credential has no expiration date: credentials created by the invitation flow, the pre-provisioned sandbox test-merchant credentials, and legacy credentials issued before expiry was introduced, until they are rotated. 0 means already expired. Expiry ends the CREDENTIAL, not the merchant's authorization: rotate it (rotation works on an expired credential), or request a token again with the same client credentials, and if the authorization is still GRANTED a fresh credential is issued with no new merchant consent. Do not cache a credential indefinitely.

scopestring

Granted scopes

status'PENDING' | 'GRANTED' | 'REVOKED'

Token status. Only GRANTED tokens are valid for API requests.

Example response

{
  "clientId": "PZAYNMVE",
  "accessToken": "aYP2LNut4cdCAGZbNFAP7VJj2leCLugm",
  "tokenType": "bearer",
  "expiresIn": 15552000,
  "scope": "resource-server-read resource-server-write"
}

Changes

No recorded changes to this operation across all 1 revision of this API.