Authentication

Obtain an OAuth access token

Request

POST https://auth-dev.spay.ng/api/v1/oauth/token
Content-Type: application/x-www-form-urlencoded
Accept: application/json

client_id=<client-id>&client_secret=<client-secret>&grant_type=client_credentials

curl

curl -X POST 'https://auth-dev.spay.ng/api/v1/oauth/token' \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Accept: application/json" \
  --data-urlencode "client_id=$SPAY_CLIENT_ID" \
  --data-urlencode "client_secret=$SPAY_CLIENT_SECRET" \
  --data-urlencode "grant_type=client_credentials"

Request fields

Field	Type	Required	Description
grant_type	string, client_credentials	Yes	The OAuth grant. Only client credentials is supported.
client_id	string	Yes, unless sent with HTTP Basic	Your client’s id.
client_secret	string	Yes, unless sent with HTTP Basic	Your client’s secret.
scope	string	No	Don’t send it. The token carries the scopes your client was set up with.

Response: 200 OK

Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache

{
  "access_token": "<access-token>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "<granted-scopes>"
}

Response fields

Field	Type	Description
access_token	string	The Bearer token to send on every API call.
token_type	string, Bearer	How to present the token.
expires_in	integer, seconds	How long the token lasts (3600).
scope	string, space-separated	The scopes the token carries. Needs no handling.

Errors

HTTP status	Body
400	{"error":"invalid_request","error_description":"Malformed token request"}
400	{"error":"unsupported_grant_type","error_description":"Grant type is not supported"}
400	{"error":"unauthorized_client","error_description":"Client is not permitted to use this grant type"}
401	{"error":"invalid_client","error_description":"Client authentication failed"}
429	{"error":"temporarily_unavailable","error_description":"Rate limit exceeded"}, with Retry-After in seconds
500	{"error":"server_error","error_description":"Token request could not be processed"}

• There is no refresh token: request a new one before expiry or on a 401.
• The token endpoint allows 60 requests a minute per source IP.
• HTTP Basic client authentication is also accepted. Use one method per request.
• A call to an endpoint your client isn’t set up for returns 403, code 63.
• Issuer https://auth-dev.spay.ng, discovery https://auth-dev.spay.ng/.well-known/openid-configuration, JWKS https://auth-dev.spay.ng/api/v1/oauth/jwks.