Issue a new access token

curl -X POST 'https://core.quidkey.com/api/v1/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "cbad8f7d-41f5-463d-967c-ca825eb65953",
    "client_secret": "98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f"
  }'

const response = await fetch('https://core.quidkey.com/api/v1/oauth2/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    client_id: 'cbad8f7d-41f5-463d-967c-ca825eb65953',
    client_secret: '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
  })
});

const { data } = await response.json();
const { access_token, refresh_token, expires_in } = data;
console.log('Access token:', access_token);

import requests

response = requests.post(
    'https://core.quidkey.com/api/v1/oauth2/token',
    json={
        'client_id': 'cbad8f7d-41f5-463d-967c-ca825eb65953',
        'client_secret': '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
    }
)

data = response.json()
access_token = data['data']['access_token']
print(f'Access token: {access_token}')

{
  "success": true,
  "data": {
    "access_token": "example_access_token_xyz789",
    "refresh_token": "example_refresh_token_abc123",
    "token_type": "Bearer",
    "expires_in": 900
  }
}

{
  "success": false,
  "error": {
    "message": "Invalid input provided"
  }
}

{
  "success": true,
  "error": {
    "code": "INVALID_INPUT",
    "message": "<string>"
  }
}

POST

api

oauth2

token

curl -X POST 'https://core.quidkey.com/api/v1/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "cbad8f7d-41f5-463d-967c-ca825eb65953",
    "client_secret": "98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f"
  }'

const response = await fetch('https://core.quidkey.com/api/v1/oauth2/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    client_id: 'cbad8f7d-41f5-463d-967c-ca825eb65953',
    client_secret: '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
  })
});

const { data } = await response.json();
const { access_token, refresh_token, expires_in } = data;
console.log('Access token:', access_token);

import requests

response = requests.post(
    'https://core.quidkey.com/api/v1/oauth2/token',
    json={
        'client_id': 'cbad8f7d-41f5-463d-967c-ca825eb65953',
        'client_secret': '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
    }
)

data = response.json()
access_token = data['data']['access_token']
print(f'Access token: {access_token}')

{
  "success": true,
  "data": {
    "access_token": "example_access_token_xyz789",
    "refresh_token": "example_refresh_token_abc123",
    "token_type": "Bearer",
    "expires_in": 900
  }
}

{
  "success": false,
  "error": {
    "message": "Invalid input provided"
  }
}

{
  "success": true,
  "error": {
    "code": "INVALID_INPUT",
    "message": "<string>"
  }
}

Exchange your client_id and client_secret for an access token. The token is valid for 15 minutes and must be included in the Authorization: Bearer <token> header of all subsequent API requests.

curl -X POST 'https://core.quidkey.com/api/v1/oauth2/token' \
  -H 'Content-Type: application/json' \
  -d '{
    "client_id": "cbad8f7d-41f5-463d-967c-ca825eb65953",
    "client_secret": "98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f"
  }'

const response = await fetch('https://core.quidkey.com/api/v1/oauth2/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    client_id: 'cbad8f7d-41f5-463d-967c-ca825eb65953',
    client_secret: '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
  })
});

const { data } = await response.json();
const { access_token, refresh_token, expires_in } = data;
console.log('Access token:', access_token);

import requests

response = requests.post(
    'https://core.quidkey.com/api/v1/oauth2/token',
    json={
        'client_id': 'cbad8f7d-41f5-463d-967c-ca825eb65953',
        'client_secret': '98c787a7b57a881e469e64579be9823a302185213de0d3835a766f1e3907982f'
    }
)

data = response.json()
access_token = data['data']['access_token']
print(f'Access token: {access_token}')

Token Lifecycle:

Validity: 15 minutes (900 seconds)
Refresh: Use the refresh_token to get a new access_token without re-authenticating
Best practice: Cache tokens and refresh before expiry

Don’t have credentials yet? Sign up at console.quidkey.com to get your client_id and client_secret for development and production environments.

Body

application/json

Request token with given grant type - client_credentials, magic_code, google_id_token, or refresh_token

Token Grant Request
Token Grant Request
Token Grant Request
Token Grant Request

Request token with given grant type - client_credentials, magic_code, google_id_token, or refresh_token

grant_type

string

required

Allowed value: "client_credentials"

client_id

string<uuid>

required

The client ID of the partner or merchant

Example:

"547544c3-eeac-492e-8df9-5a52ca4e6bdf"

client_secret

string

required

The client secret of the partner or merchant

Example:

"b717adcac3f26e8034574021fa647cd7d4edd67b615046df387f6712c3601048"

Response

Success

success

boolean

required

Indicates if the request was successful

Example:

true

data

object

required

Show child attributes

API Reference Refresh an existing access token

Overview

Authentication

Embedded Payment Flow

Payment Links

Webhooks

Issue a new access token

Body

Response