Get an access token
LiveServed by the v1 API in development with the same checks as production; production opens on the same contract. The capabilities from before v1 keep running in production at the path your account team gives you.
Exchanges your client credentials for a bearer token valid for one hour (OAuth 2.0 client credentials grant, RFC 6749). Send the token as Authorization: Bearer <token> on every other operation.
This endpoint lives at the root of the environment, not under /v1: https://api.b2b.heru.app/oauth/token in production and https://api.dev.b2b.heru.app/oauth/token in development. A client only works in the environment it was issued for.
Send the client in the form body, as below, or with HTTP Basic; a JSON body with the same fields is accepted too. Leave scope out to get every scope of the client, or list the ones you need separated by spaces to get a narrower token. Errors follow RFC 6749: error and error_description, not the code shape of the rest of the API. Responses are never cached.
application/x-www-form-urlencoded- body
grant_type*"client_credentials"Always client_credentials.
"client_credentials"client_id*stringThe id of your client. Also accepted as the user of an HTTP Basic header.
client_secret*stringOne of the active secrets of your client. Also accepted as the password of an HTTP Basic header.
scope?stringOptional. Scopes separated by spaces. Without it the token carries every scope of the client.
The token. Cache-Control: no-store.
application/json- response
access_token*stringA JWT signed with ES256. Send it as a bearer token.
token_type*"Bearer""Bearer"expires_in*integerSeconds the token lives: 3600.
scope*stringThe scopes of the token, separated by spaces.
curl -X POST 'https://api.dev.b2b.heru.app/oauth/token' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'grant_type=client_credentials'{ "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbGllbnQifQ.c2lnbmF0dXJl", "token_type": "Bearer", "expires_in": 3600, "scope": "merchants:read charges:write"}All operations
Every v1 operation, generated from the OpenAPI 3.1 contract.
Get the caller of the tokenGET
Answers which client, organization, company and scopes the access token you send carries. Use it to check your credentials before you build on them. It needs no scope, only a valid token. Responses are never cached.