Access Token

Create Access Token

POST
/accesstoken

Create a bearer access token.

Using your app credentials, send a request to create a bearer access token that can be used to execute subsequent API actions. The actions that the token can execute are determined by the permissions the app has.

Header Parameters

X-GP-Version*string

The version of the API to execute the request.

Length1 <= length <= 50
Default"2021-03-22"

Request Body

application/json

app_id*string

The id of the app that was used to create the token.

Length1 <= length <= 50
nonce*string

A unique random value used to create the secret. The integrator must ensure this is unique and different for every request to create an access token.

Length1 <= length <= 50
secret*string

A unique string created using the nonce and app-key. This value is used to further authenticate the request. Created as follows - SHA512(NONCEAPP-KEY

Length1 <= length <= 200
grant_type*"client_credentials"

This is an Oauth specific field that must be set to client_credentials. This indicates to the platform to give access to the apps own resources.

  • client_credentials
Length1 <= length <= 50

Value in

  • "client_credentials"
seconds_to_expire?number

The time in seconds that the access token will expire and can no longer be used.

Length60 <= length <= 604800
restricted_token?restricted_token_ACCESS_TOKEN.restricted_token

Masks the account, merchant and app details that is returned in the response to a tokenisation request.

  • YES - A restricted access token will be created. Restricted access token is used when integrating with Drop-in UI or Hosted Fields to create a single-use payment token.
  • NO - A restricted access token will not be created.

Value in

  • "YES"
  • "NO"
interval_to_expire?string

The time interval set for when the token will expire.

  • WEEK
  • DAY
  • 12_HOURS
  • 6_HOURS
  • 3_HOURS
  • 1_HOUR
  • 30_MINUTES
  • 10_MINUTES
  • 5_MINUTES

Value in

  • "WEEK"
  • "DAY"
  • "12_HOURS"
  • "6_HOURS"
  • "3_HOURS"
  • "1_HOUR"
  • "30_MINUTES"
  • "10_MINUTES"
  • "5_MINUTES"
permissions?array<>

All of the permissions or activites that may be performed by the account.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/accesstoken" \  -H "X-GP-Version: 2021-03-22" \  -H "Content-Type: application/json" \  -d '{    "app_id": "i9R0byBBor6RqTQNj3g4MuVBwH5rd7yR",    "nonce": "random_string",    "secret": "e776ce1d9e94d5072ee132258e446cd92668d7c28b2e475a345319b475ba601956c16e3983926ce279db6301d78b7f47cfb729e41b4169814e373f0a0bf38716",    "grant_type": "client_credentials"  }'
{  "token": "AEI2ptJfKM1Wb5TFZxBDWFZA7Se7",  "type": "Bearer",  "scope": {    "merchant_id": "MER_A6A1EC44522F96630ABEA17A",    "merchant_name": "ABC INDUSTRIES",    "accounts": [      {        "id": "TRA_be83259a-455e-4ce6-a53a-6d5d31c79d41",        "name": "North American Website",        "permissions": [          "TRN_POST_Authorize"        ]      }    ]  },  "app_id": "uzFr7t4VOqxdLDI44hHmXIjHtOOE8d",  "app_name": "my_lovely_app",  "time_created": "2021-05-03T21:23:39.718Z",  "seconds_to_expire": 0,  "interval_to_expire": "1_HOUR",  "email": "james.mason@example.com"}