POST/oauth/client_credential/accesstoken

Auth Specification

This chapter contains information on what is required to make a successful request with the Authorization API. You will need credentials for basic authentication. Our Postman collection also contains an authorisation API call. Download the postman collection to set it up :

How does it work?

You need an access token to use the API. To obtain an access token you need to call the oAuth API. The oAuth 2.0 specifications recommend passing the API key and secret values as an HTTP-Basic Authentication header.

Your API key and secret need to be base64 encoded before you can send them in the header.

In pseudo-code:
result = Base64Encode(concat('ns4fQc14Zg4hKFCNaSzArVuwszX95X11', ':','ZIjFyTsNgQN1yxI'))

In this example, ns4fQc14Zg4hKFCNaSzArVuwszX95X11 is the API key and ZIjFyTsNgQN1yxI is the secret.

The result being: bnM0ZlFjMTRaZzRoS0ZDTmFTekFyVnV3c3pYOTV3YOlpJakZ5VHNOZ1FOeXhJ==

Headers

To ensure full compatibility with industry standards, our RFC-compliant solution is now the default for all new implementations, with legacy setups gradually being phased out.

  • Content-Typeapplication/x-www-form-urlencodedMandatory

    Content type and encoding of the request.

  • AuthorizationBasicMandatory

    Basic authorisation token.

Request body

  • data-urlencodegrant_type=client_credentialsMandatory

    We only support the grant_type: client_credentials.

Request Curl example

curl --location --request POST '<hostValueWillBeSharedBySurePay>/oauth/client_credential/accesstoken?response_format=standard' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic <your basic token>' \
--data-urlencode 'grant_type=client_credentials'
  • Replace <hostValueWillBeSharedBySurePay> with the url provided via MSafe by SurePay, and replace <your basic token> with your own base64 encoded API key and secret.

Response body

On a succesful request, you will receive an access_token as well as some other information about your customer profile, your products when your token was issued and after how many seconds it expires. At SurePay we do not work with refresh_tokens. You can not refresh this token. It is advised to make another API call with basic authentication to fetch a new access_token when this one expires.

To ensure full compatibility with industry standards, our RFC-compliant solution is now the default for all new implementations, with legacy setups gradually being phased out.

RFC Compliant Response

  • refresh_token_expires_inStringMandatory

    Always returned as '0'.

  • api_product_listStringMandatory

    This is the list of products currently active.

  • api_product_list_jsonArray of StringsMandatory

    This is the list of products currently active as an array of strings.

  • organization_nameStringMandatory

    The organization's name as registered within SurePay's VoP platform.

  • developer.emailStringMandatory

    The email address associated with this API key.

  • token_typeStringMandatory

    This is the type of token issued.

    • Example: Bearer
  • issued_atStringMandatory

    The time the access token was issued. This refers to the milliseconds since the epoch, which is 1 Jan 1970 UTC.

  • client_idStringMandatory

    The client_id as passed in the request.

  • access_tokenStringMandatory

    This is the access token issued.

  • application_nameStringMandatory

    The id associated to the application making the request.

  • scopeStringOptional

    The scope for this token.

  • expires_inIntegerMandatory

    When the access token expires. Configurable on SurePay's side, default is 1 hour.

    • Example: 3599
  • refresh_countStringMandatory

    Always returned as '0'.

  • statusStringMandatory

    The status of the request.

non-RFC Compliant Response

  • refresh_token_expires_inStringMandatory

    Always returned as '0'.

  • api_product_listStringMandatory

    This is the list of products currently active.

  • api_product_list_jsonArray of StringsMandatory

    This is the list of products currently active as an array of strings.

  • organization_nameStringMandatory

    The organization's name as registered within SurePay's VoP platform.

  • developer.emailStringMandatory

    The email address associated with this API key.

  • token_typeStringMandatory

    This is the type of token issued.

    • Example: BearerToken
  • issued_atStringMandatory

    The time the access token was issued. This refers to the milliseconds since the epoch, which is 1 Jan 1970 UTC.

  • client_idStringMandatory

    The client_id as passed in the request.

  • access_tokenStringMandatory

    This is the access token issued.

  • application_nameStringMandatory

    The id associated to the application making the request.

  • scopeStringOptional

    The scope for this token.

  • expires_inStringMandatory

    When the access token expires. Configurable on SurePay's side, default is 1 hour.

    • Example: 3599
  • refresh_countStringMandatory

    Always returned as '0'.

  • statusStringMandatory

    The status of the request.

Response example

{
    {
        "refresh_token_expires_in": "0",
        "api_product_list": "[Account Check V2 - Banks - Acc]",
        "api_product_list_json": [
            "Account Check V2 - Banks - Acc"
        ],
        "organization_name": "SurePay",
        "developer.email": "service@surepay.nl",
        "token_type": "Bearer",
        "issued_at": "1693214579017",
        "client_id": "<your client ID>",
        "access_token": "<your bearer token>",
        "application_name": "8ce4bc06-07c2-4e4e-9dfe-1234567ef7d3",
        "scope": "",
        "expires_in": 3599,
        "refresh_count": "0",
        "status": "approved"
    }
}
Previous
Next