Authentication

Our API uses M2M clients to authenticate your application. Each M2M client has a client_id and client_secret, and uses the OAuth2 client credentials flow to obtain a short-lived access token.

Obtain an access token

POST /oauth2/token

string

required

Must be application/x-www-form-urlencoded.

string

required

Must be client_credentials.

string

required

Your M2M client ID.

string

required

Your M2M client secret.

curl --request POST \
  --url 'https://api.paysway.dev/oauth2/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET

{
  "access_token": "ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600
}

Use the token

Include the token in the Authorization header of every API request:

string

required

Bearer YOUR_ACCESS_TOKEN

curl --request POST \
  --url https://api.paysway.dev/payments/validations \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Tokens expire after 3600 seconds. If you receive a 401 Unauthorized, request a new token. Consider refreshing proactively before expiry to avoid interruptions.

Introduction Versioning

Get Started

Payment Preparation

Beneficiary Hub

Webhooks

Obtain an access token

Use the token

​Obtain an access token

​Use the token

Obtain an access token

Use the token