Grant (authorization code, client credentials, or refresh token)

Use the authorization code from each of your merchants to get access credentials.

This single operation covers the three grants the source documents separately on the same POST /token endpoint, distinguished only by grant_type:

Authorization code grant (source lines 50-97): the authorization code grant type is used to obtain both access tokens and refresh tokens by presenting a one-time authorization code obtained from Payfirma's authorization server during the authorization request.
Client Credentials Grant (source lines 99-143): the client credentials grant uses client id and client secret as an authorization grant when the authorization scope is limited to the protected resources under the control of the client. Client credentials are used as an authorization grant typically when the client is acting on its own behalf (the client is also the resource owner).
Refresh token grant (source lines 145-189): the client can request a new access token by authenticating with the Payfirma authorization server and then presenting the refresh token.

Body

required

application/json

Responses

application/json

post/token

curl https://auth.payfirma.com/oauth/token \
  --request POST \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header 'Authorization: Basic username:password' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'code=' \
  --data-urlencode 'redirect_uri=' \
  --data-urlencode 'state='

Show Schema

Authorization code grant (source lines 88-97)

{
  "access_token": "eyJhbGciOiJIUzI1NiJ9.eyJhY2Nlc3NfdG9rZW4iOiIxM2EyN2ViZS1iZTEwLTQzY2ItYjFmOC1lYjY4ZWEwOGFlNGIiLCJleHAiOjE0NTcwNTU0NjN9._KIfokRmM38MjP-q2pxB6Lk_-dcg2VnLg9QiuwksxKU",
  "token_type": "Bearer",
  "refresh_token": "955d8714-f1d6-49d6-830a-2d221631a2b3",
  "expires_in": 1199,
  "merchant_id": "01234abcde",
  "scope": "invoice ecom"
}

The response body documented in the source. No status code is stated.

Revoke token

Customer