OAuth2

Request authorization token

Requests an OAuth2 authorization token for a merchant using client credentials. The token starts as PENDING until the merchant grants authorization. If an existing GRANTED authorization exists but the token credential has expired, a new credential is generated automatically without requiring merchant re-consent.

post/oauth2/tokens

Request

  • Base URL: https://api.payware.eu
  • URL: https://api.payware.eu/oauth2/tokens
  • Auth: HTTP bearer

Request body

grantTypestring

Grant type. Only "client_credentials" is supported.

clientIdstring

The merchant's partnerId

clientSecretstring

Base64-encoded merchant pairing key. The field is named client_secret because RFC 6749 names it that; it is the value the merchant gave you so you can REQUEST authorization. The request is created PENDING and confers no access until the merchant grants it.

Example request

{
  "grantType": "client_credentials",
  "clientId": "PZAYNMVE",
  "clientSecret": "YVlQMkxOdXQ0Y2RDQUdaYk5GQVA3VkpqMmxlQ0x1Z20="
}

Response

Token created or already exists

clientIdstring

The merchant's partnerId

accessTokenstring

The access token

tokenTypestring

Token type. Only "bearer" is supported.

expiresIninteger nullable

Seconds until this token credential stops being accepted, per the OAuth2 meaning of expires_in. A credential requested with POST /oauth2/tokens expires 180 days (by default) after the merchant grants authorization, and a rotated one 180 days after the rotation. NULL means the credential has no expiration date: credentials created by the invitation flow, the pre-provisioned sandbox test-merchant credentials, and legacy credentials issued before expiry was introduced, until they are rotated. 0 means already expired. Expiry ends the CREDENTIAL, not the merchant's authorization: rotate it (rotation works on an expired credential), or request a token again with the same client credentials, and if the authorization is still GRANTED a fresh credential is issued with no new merchant consent. Do not cache a credential indefinitely.

scopestring

Granted scopes

status'PENDING' | 'GRANTED' | 'REVOKED'

Token status. Only GRANTED tokens are valid for API requests.

Example response

{
  "clientId": "PZAYNMVE",
  "accessToken": "aYP2LNut4cdCAGZbNFAP7VJj2leCLugm",
  "tokenType": "bearer",
  "expiresIn": 15552000,
  "scope": "resource-server-read resource-server-write"
}

Changes

No recorded changes to this operation across all 1 revision of this API.