Skip to main content

Authentication

KartaPay uses OAuth2 client_credentials (OIDC) for API authentication. Create a key on the API Keys page of the Developer section of your KartaPay dashboard to get a Client ID and Client Secret.

Request a token​

curl --location 'https://auth.kartapay.me/staging/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'client_id=xxx' \
  --data-urlencode 'client_secret=xxx' \
  --data-urlencode 'grant_type=client_credentials'

Response​

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ...",
  "expires_in": 3600,
  "refresh_expires_in": 0,
  "token_type": "Bearer",
  "not-before-policy": 0,
  "scope": "merchant-api-jwt-scope"
}

The token expires after 1 hour (expires_in: 3600). Request a new token when it expires — there is no refresh token (refresh_expires_in is always 0).

Use the access_token as a Bearer token in the Authorization header of every KartaPay API request.

:::tip Next step See Environments for the hosts to use in staging and production. :::