Obtain an access token

POST

/oauth/token

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://example.com/oauth/token");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Content-Type: application/x-www-form-urlencoded");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example");

CURLcode ret = curl_easy_perform(hnd);

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    RequestUri = new Uri("https://example.com/oauth/token"),
    Content = new FormUrlEncodedContent(new Dictionary<string, string>
    {
        { "grant_type", "client_credentials" },
        { "client_id", "example" },
        { "client_secret", "example" },
        { "code", "example" },
        { "code_verifier", "example" },
        { "redirect_uri", "example" },
        { "refresh_token", "example" },
    }),
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://example.com/oauth/token"

  payload := strings.NewReader("grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Content-Type", "application/x-www-form-urlencoded")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://example.com/oauth/token"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .method("POST", HttpRequest.BodyPublishers.ofString("grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example"))
    .build();
HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/x-www-form-urlencoded");
RequestBody body = RequestBody.create(mediaType, "grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example");
Request request = new Request.Builder()
  .url("https://example.com/oauth/token")
  .post(body)
  .addHeader("Content-Type", "application/x-www-form-urlencoded")
  .build();

Response response = client.newCall(request).execute();

import axios from 'axios';

const encodedParams = new URLSearchParams();
encodedParams.set('grant_type', 'client_credentials');
encodedParams.set('client_id', 'example');
encodedParams.set('client_secret', 'example');
encodedParams.set('code', 'example');
encodedParams.set('code_verifier', 'example');
encodedParams.set('redirect_uri', 'example');
encodedParams.set('refresh_token', 'example');

const options = {
  method: 'POST',
  url: 'https://example.com/oauth/token',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  data: encodedParams,
};

try {
  const { data } = await axios.request(options);
  console.log(data);
} catch (error) {
  console.error(error);
}

const url = 'https://example.com/oauth/token';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: new URLSearchParams({
    grant_type: 'client_credentials',
    client_id: 'example',
    client_secret: 'example',
    code: 'example',
    code_verifier: 'example',
    redirect_uri: 'example',
    refresh_token: 'example'
  })
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

val client = OkHttpClient()

val mediaType = MediaType.parse("application/x-www-form-urlencoded")
val body = RequestBody.create(mediaType, "grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example")
val request = Request.Builder()
  .url("https://example.com/oauth/token")
  .post(body)
  .addHeader("Content-Type", "application/x-www-form-urlencoded")
  .build()

val response = client.newCall(request).execute()

use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://example.com/oauth/token";

    let payload = json!({
        "grant_type": "client_credentials",
        "client_id": "example",
        "client_secret": "example",
        "code": "example",
        "code_verifier": "example",
        "redirect_uri": "example",
        "refresh_token": "example"
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Content-Type", "application/x-www-form-urlencoded".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.post(url)
        .headers(headers)
        .form(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request POST \
  --url https://example.com/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=example \
  --data client_secret=example \
  --data code=example \
  --data code_verifier=example \
  --data redirect_uri=example \
  --data refresh_token=example

wget --quiet \
  --method POST \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --body-data 'grant_type=client_credentials&client_id=example&client_secret=example&code=example&code_verifier=example&redirect_uri=example&refresh_token=example' \
  --output-document \
  - https://example.com/oauth/token

RFC 6749 token endpoint. For an integration: grant_type=client_credentials with your merchant credentials (body, or HTTP Basic) — the access token then opens every /api search and refund door for YOUR merchant, for expires_in seconds; re-authenticate when it lapses. The authorization_code/refresh_token grants serve the dashboard’s human login and are not for integrations. Errors speak the RFC’s dialect ({error}), and invalid_grant is deliberately uniform — it never says which hurdle fell.

Request Body^required

RFC 6749 — the body travels as application/x-www-form-urlencoded, never JSON.

application/x-www-form-urlencoded

RFC 6749 — the body travels as application/x-www-form-urlencoded, never JSON.

object

grant_type

required

client_credentials is the INTEGRATION grant — your server authenticating as itself. The other two belong to the dashboard’s login flow and are not for integrations.

string

Allowed values: client_credentials authorization_code refresh_token

client_id

Client_credentials: your merchantId — or send both credentials as HTTP Basic (Authorization: Basic base64(merchantId:secret)), both shapes are standard.

string

client_secret

Client_credentials: your merchant secret — body or HTTP Basic.

string

code

Dashboard login flow (authorization_code) only.

string

code_verifier

Dashboard login flow (PKCE) only.

string

redirect_uri

Dashboard login flow only.

string

refresh_token

Dashboard flow (refresh_token grant) only.

string

Responses

200

The token, RFC 6749 §5.1.

application/json

object

access_token

required

The Bearer JWT for the /api surface — send it as Authorization: Bearer ….

string

token_type

required

Always Bearer — present the token as Authorization: Bearer <token>.

string

Allowed value: Bearer

expires_in

required

Seconds of validity. When it lapses, a machine simply re-authenticates: client_credentials issues NO refresh token.

integer

refresh_token

Dashboard flow only — rotating, and the whole family burns on a replay.

string

Example

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJtMTEiLCJ0eXAiOiJtZXJjaGFudCJ9.9pQ2…",
  "token_type": "Bearer",
  "expires_in": 3600
}

400

invalid_request, unsupported_grant_type — or the uniform invalid_grant, which never says which hurdle fell.

application/json

object

error

required

RFC 6749 error code — invalid_client, unsupported_grant_type… Branch on this.

string

error_description

Human-readable detail, when there is one to give.

string

Example

{
  "error": "unsupported_grant_type",
  "error_description": "grant_type must be client_credentials"
}

401

invalid_client — unknown or wrong credentials, one answer for both.

application/json

object

error

required

RFC 6749 error code — invalid_client, unsupported_grant_type… Branch on this.

string

error_description

Human-readable detail, when there is one to give.

string

Example

{
  "error": "invalid_client",
  "error_description": "unknown client or wrong secret"
}

Obtain an access token

Request Bodyrequired

Responses

200

Example

400

Example

401

Example

Request Body^required