> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paysway.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

Our API uses **M2M clients** to authenticate your application. Each M2M client has a `client_id` and `client_secret`, and uses the OAuth2 client credentials flow to obtain a short-lived access token.

## Get your credentials

Create and manage M2M clients in the [Dashboard](https://dashboard.paysway.io/settings/api).

<Info>
  No dashboard access yet? Contact us directly or get started [here](https://paysway.io/get-started).
</Info>

## Obtain an access token

**POST /oauth2/token**

<ParamField header="Content-Type" type="string" required>
  Must be `application/x-www-form-urlencoded`.
</ParamField>

<ParamField body="grant_type" type="string" required>
  Must be `client_credentials`.
</ParamField>

<ParamField body="client_id" type="string" required>
  Your M2M client ID.
</ParamField>

<ParamField body="client_secret" type="string" required>
  Your M2M client secret.
</ParamField>

<CodeGroup>
  ```shell Request theme={null}
  curl --request POST \
    --url 'https://api.paysway.dev/oauth2/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data grant_type=client_credentials \
    --data client_id=YOUR_CLIENT_ID \
    --data client_secret=YOUR_CLIENT_SECRET
  ```

  ```json Response theme={null}
  {
    "access_token": "ACCESS_TOKEN",
    "token_type": "Bearer",
    "expires_in": 3600
  }
  ```
</CodeGroup>

## Use the token

Include the token in the `Authorization` header of every API request:

<ParamField header="Authorization" type="string" required>
  `Bearer YOUR_ACCESS_TOKEN`
</ParamField>

```shell theme={null}
curl --request POST \
  --url https://api.paysway.dev/payments/validations \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

<Warning>
  Tokens expire after 3600 seconds. If you receive a `401 Unauthorized`, request a new token. Consider refreshing proactively before expiry to avoid interruptions.
</Warning>