Get an access token

• Sandbox: POST https://payme-store-staging.payme.io/api/auth-tokens
• Production: POST https://payme-store.payme.io/api/auth-tokens

Credentials

No credentials are documented for this endpoint.

Exchanges a seller's MPL and its partner's payme_client_key for an access token and a refresh token. Send the access token as Authorization: Bearer <auth_token> on every product and customer call.

Only partners can get a token: the seller in mpl must belong to the partner whose key you send in key. When the access token expires, get a new pair with POST /refresh-exchanges.

Wrong or mismatched credentials return an error; read status_error_details. The HTTP status can be 400, 401 or 500, depending on how PayMe's core rejects the credentials.

Hosts and the error format: Hosts, authentication and errors.

Parameters

This endpoint takes no path, query or header parameters.

Request body

Content type: application/json

The seller and partner credentials.

Request example

{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}

Code samples

curl

curl -X POST 'https://payme-store-staging.payme.io/api/auth-tokens' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}'

Node.js

const response = await fetch("https://payme-store-staging.payme.io/api/auth-tokens", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
    "key": "your_payme_client_key"
  }),
});

console.log(await response.text());

Python

import requests

response = requests.post(
    "https://payme-store-staging.payme.io/api/auth-tokens",
    json={
        "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
        "key": "your_payme_client_key",
    },
)

print(response.text)

PHP

<?php

$body = <<<'BODY'
{
  "mpl": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "key": "your_payme_client_key"
}
BODY;

$ch = curl_init('https://payme-store-staging.payme.io/api/auth-tokens');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Responses

201 — Tokens issued. (success)

{
  "auth_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI3YzFlNGQ5YSJ9.c2lnbmF0dXJl",
  "refresh_token": "b6f0d3a2-8c41-4e5f-9a7d-2e1c0b9f4a53"
}

400 — mpl or key is missing or not a string, or the body isn't valid JSON. Wrong credentials can also return 400. (error)

{
  "status_error_details": "Field validation failed.",
  "validation_errors": {
    "key": {
      "is_not_empty": "The field is required.",
      "is_string": "The value must be a string."
    }
  },
  "status_error_code": 501,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}

401 — The credentials don't identify a seller of this partner. (error)

{
  "status_error_details": "No Genesis identity found for the credentials",
  "status_error_code": 999,
  "session": "f3a1c2b0-9e4d-11ef-8c1a-0242ac120002"
}

500 — Server error. Wrong credentials can also return 500. Contact PayMe support and quote the session. (error)