Authentication

Exchange your API client ID and secret for a short-lived OAuth access token. Each API client works in one environment, and its secret is shown only once. Request only the scopes you need, never keep the token or secret in browser storage, and rotate or revoke the client from the dashboard.

1. 1
   Create an API client

   Create the API client in Developers → API clients. Copy its secret straight into your server's secret store; it is shown only once.

2. 2
   Ask only for the scopes you need

   Send the client ID and secret only to /oauth/token, name the scopes you need, and send the returned bearer token to the API over HTTPS.

3. 3
   Recover safely

   A 401 invalid_token means the token was not accepted, not that a payment failed. Get a new token, then retry the same request with its original idempotency key.